core dump when opening a epub file

[jirib]

 * Xreader version (xreader --version): xreader 3.3.0
 * Distribution: OpenSUSE TW (updates from 2022-06-13)

Issue

$ einfo /tmp/out.epub
Filename:        /tmp/out.epub
Root(s):
   EPUB/content.opf (application/oebps-package+xml)
Title(s):
   Creator(s):
   Identifier(s):
   urn:uuid:cc2cb951-cd66-4f4e-a546-69e11aa2f7d2(unspecified:epub-id-1)
Reading order:
   title_page_xhtml ch001_xhtml(L) 
Guide:
   UNTITLED -> nav.xhtml(toc)
Extra local metadata:
unspecified : unspecified

$ file /tmp/out.epub
/tmp/out.epub: EPUB document

$ coredumpctl dump 32545 -o /tmp/out
$ gdb -batch -n -ex 'set pagination off' -ex bt -ex 'bt full' `which xreader` /tmp/out

warning: Can't open file /SYSV00000000 (deleted) during file-backed mapping note processing

warning: Can't open file /home/jiri/.config/dconf/user (deleted) during file-backed mapping note processing

warning: Can't open file /run/user/1000/dconf/user (deleted) during file-backed mapping note processing
[New LWP 32711]
[New LWP 32545]
[New LWP 32558]
[New LWP 32547]
[New LWP 32546]
[New LWP 32560]
[New LWP 32561]
[New LWP 32562]
[New LWP 32563]
[New LWP 32573]
[New LWP 32549]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `xreader'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fe0d0d1b60f in xml_get_data_from_node (node=<optimized out>, rettype=<optimized out>, attributename=<optimized out>) at ../backend/epub/epub-document.c:614
614	xml_get_data_from_node(xmlNodePtr node,
[Current thread is 1 (Thread 0x7fe0d3edb640 (LWP 32711))]
#0  0x00007fe0d0d1b60f in xml_get_data_from_node (node=<optimized out>, rettype=<optimized out>, attributename=<optimized out>) at ../backend/epub/epub-document.c:614
#1  xml_get_data_from_node (attributename=0x0, rettype=XML_KEYWORD, node=0x0) at ../backend/epub/epub-document.c:614
#2  epub_document_set_document_title (containeruri=0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf") at ../backend/epub/epub-document.c:1621
#3  epub_document_load (document=<optimized out>, uri=<optimized out>, error=0x7fe0d3eda8a0) at ../backend/epub/epub-document.c:1774
#4  0x00007fe0e21756d4 in ev_document_load (document=document@entry=0x564f484299a0 [EpubDocument], uri=uri@entry=0x564f484b1a50 "file:///tmp/out.epub3", error=error@entry=0x7fe0d3eda910) at ../libdocument/ev-document.c:249
#5  0x00007fe0e217606b in ev_document_factory_get_document (uri=0x564f484b1a50 "file:///tmp/out.epub3", error=error@entry=0x7fe0d3eda960) at ../libdocument/ev-document-factory.c:237
#6  0x00007fe0e21ba18c in ev_job_load_run (job=0x7fe0cc005f20 [EvJobLoad]) at ../libview/ev-jobs.c:1124
#7  0x00007fe0e21b921f in ev_job_thread (job=0x7fe0cc005f20 [EvJobLoad]) at ../libview/ev-job-scheduler.c:184
#8  ev_job_thread_proxy (data=<optimized out>) at ../libview/ev-job-scheduler.c:217
#9  0x00007fe0e1e501b5 in g_thread_proxy (data=0x564f4858b4c0) at ../glib/gthread.c:827
#10 0x00007fe0e1023767 in start_thread (arg=<optimized out>) at pthread_create.c:442
#11 0x00007fe0e10adc10 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
#0  0x00007fe0d0d1b60f in xml_get_data_from_node (node=<optimized out>, rettype=<optimized out>, attributename=<optimized out>) at ../backend/epub/epub-document.c:614
        datastring = 0x7fe06000c5f0 "\234D\006\236\347\177"
        datastring = <optimized out>
        doctitle = <optimized out>
        title = 0x0
        epub_document = 0x564f484299a0 [EpubDocument]
        err = 0x0
        containerpath = 0x564f47dad8a0
        containeruri = 0x7fe06000c5f0 "\234D\006\236\347\177"
        contentOpfUri = 0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf"
#1  xml_get_data_from_node (attributename=0x0, rettype=XML_KEYWORD, node=0x0) at ../backend/epub/epub-document.c:614
        datastring = <optimized out>
        doctitle = <optimized out>
        title = 0x0
        epub_document = 0x564f484299a0 [EpubDocument]
        err = 0x0
        containerpath = 0x564f47dad8a0
        containeruri = 0x7fe06000c5f0 "\234D\006\236\347\177"
        contentOpfUri = 0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf"
#2  epub_document_set_document_title (containeruri=0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf") at ../backend/epub/epub-document.c:1621
        doctitle = <optimized out>
        title = 0x0
        epub_document = 0x564f484299a0 [EpubDocument]
        err = 0x0
        containerpath = 0x564f47dad8a0
        containeruri = 0x7fe06000c5f0 "\234D\006\236\347\177"
        contentOpfUri = 0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf"
#3  epub_document_load (document=<optimized out>, uri=<optimized out>, error=0x7fe0d3eda8a0) at ../backend/epub/epub-document.c:1774
        epub_document = 0x564f484299a0 [EpubDocument]
        err = 0x0
        containerpath = 0x564f47dad8a0
        containeruri = 0x7fe06000c5f0 "\234D\006\236\347\177"
        contentOpfUri = 0x7fe06000c640 "file:///tmp/xreader-32545/out.epub3HA5MN1/EPUB/content.opf"
#4  0x00007fe0e21756d4 in ev_document_load (document=document@entry=0x564f484299a0 [EpubDocument], uri=uri@entry=0x564f484b1a50 "file:///tmp/out.epub3", error=error@entry=0x7fe0d3eda910) at ../libdocument/ev-document.c:249
        klass = 0x7fe060003550
        retval = <optimized out>
        err = 0x0
#5  0x00007fe0e217606b in ev_document_factory_get_document (uri=0x564f484b1a50 "file:///tmp/out.epub3", error=error@entry=0x7fe0d3eda960) at ../libdocument/ev-document-factory.c:237
        document = 0x564f484299a0 [EpubDocument]
        result = <optimized out>
        compression = EV_COMPRESSION_NONE
        uri_unc = <optimized out>
        err = 0x0
        __func__ = "ev_document_factory_get_document"
#6  0x00007fe0e21ba18c in ev_job_load_run (job=0x7fe0cc005f20 [EvJobLoad]) at ../libview/ev-jobs.c:1124
        job_load = 0x7fe0cc005f20 [EvJobLoad]
        error = 0x0
#7  0x00007fe0e21b921f in ev_job_thread (job=0x7fe0cc005f20 [EvJobLoad]) at ../libview/ev-job-scheduler.c:184
        result = <optimized out>
        job = 0x564f484afe50
#8  ev_job_thread_proxy (data=<optimized out>) at ../libview/ev-job-scheduler.c:217
        job = 0x564f484afe50
#9  0x00007fe0e1e501b5 in g_thread_proxy (data=0x564f4858b4c0) at ../glib/gthread.c:827
        thread = 0x564f4858b4c0
        __func__ = "g_thread_proxy"
#10 0x00007fe0e1023767 in start_thread (arg=<optimized out>) at pthread_create.c:442
        ret = <optimized out>
        pd = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140603604973120, -6123954522589846951, -128, 0, 140734577120272, 140603596582912, 6107708020331029081, 6107608742281912921}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#11 0x00007fe0e10adc10 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Steps to reproduce

• just opening the file (i can provide the file privately)

Expected behaviour

should open

[casual-coffee]

I have no experience in this project but i still tried debugging this problem. I found out the following:

Requirements for reproducing

This problem occurs, when a epub file does not have a title in its metadata. From your einfo output we can see, that there is no title specified for the file, you tried out back then:

$ einfo /tmp/out.epub
Filename:        /tmp/out.epub
Root(s):
   EPUB/content.opf (application/oebps-package+xml)
Title(s):
   Creator(s):

Theoretically, this problem should not occur because epubs must provide a title (https://www.w3.org/TR/epub-34/#sec-opf-dctitle) but here we are.

Reason in code

In the file backend/epub/epub-document.c we can find the following function, which is supposed to read the epub's title from the *.opf file of the epub:

static gchar*
epub_document_set_document_title(gchar *containeruri)
{
	open_xml_document(containeruri);
	gchar *doctitle;
	set_xml_root_node(NULL);

	xmlNodePtr title = xml_get_pointer_to_node((xmlChar*)"title",NULL,NULL);

	doctitle = (gchar*)xml_get_data_from_node(title, XML_KEYWORD, NULL);
	xml_free_doc();

	return doctitle;
}

Problem

When there is no <dc:title ...>...<dc:title> in the metadata tags of the opf-file, the function xml_get_pointer_to_node() will return NULL. This null value will then be provided for the xml_get_data_from_node() function. Currently this function does not handle NULL values provided as input and uses this value as input using node->xmlChrildrenNode, which probably throws the segmentation fault.

static xmlChar*
xml_get_data_from_node(xmlNodePtr node,
                       xmlParseReturnType rettype,
                       xmlChar* attributename)
{
    xmlChar* datastring ;
    if ( rettype == XML_ATTRIBUTE )
       datastring= xmlGetProp(node,attributename);
    else
       datastring= xmlNodeListGetString(xmldocument,node->xmlChildrenNode, 1);

    return datastring;
}

Solution

To fix this problem, we probably only need to handle NULL values for node by returning NULL or an empty string.

static xmlChar*
xml_get_data_from_node(xmlNodePtr node,
                       xmlParseReturnType rettype,
                       xmlChar* attributename)
{
    xmlChar* datastring ;

    if (node == NULL)
    	return NULL;

    if ( rettype == XML_ATTRIBUTE )
       datastring= xmlGetProp(node,attributename);
    else
       datastring= xmlNodeListGetString(xmldocument,node->xmlChildrenNode, 1);

    return datastring;
}

Now the epub should open and not throw a segmentation fault anymore. As soon as i figure out how, i will make a pull request for this fix.

[jirib]

I'm using Fedora now and xreader in Fedora is built without EPUB support: https://src.fedoraproject.org/rpms/xreader/blob/rawhide/f/xreader.spec#_103 .

In any case, this seems to be a reproducer:

$ printf 'Hello world!\n' | pandoc -t epub -s -o /tmp/out.epub

$ einfo /tmp/out.epub 
Filename:	 /tmp/out.epub
Root(s):
   EPUB/content.opf (application/oebps-package+xml)
Title(s):
   Creator(s):
   Identifier(s):
   urn:uuid:c63f498f-6939-4b5c-bbe5-70063b14a114(unspecified:epub-id-1)
Reading order:
   title_page_xhtml ch001_xhtml(L) 
Guide:
   UNTITLED -> nav.xhtml(toc)
Extra local metadata:
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified
unspecified : unspecified

(The einfo output looks the same as for my original report. And... it crashes atril as well...)

@casual-coffee Thank you for your work.