Thread-safety bugs in package libpoppler-glib8
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| poppler (Ubuntu) |
Triaged
|
Low
|
Unassigned | ||
Bug Description
There are these bugs in libpoppler-glib8:
https:/
https:/
The first is about sharing cairo_font_face_t instances in multiple threads which is not thread-safe. The second is about accessing global linked list struct without proper synchronisation mechanism.
Due to these two bugs poppler+cairo cannot be used for rendering multiple documents in multiple threads.
The second may be potentially security vulnerability for applications that use poppler+cairo in multiple threads due to writes to potentially uninitialised pointer.
I noticed that poppler source package contains a lot of patches from ubuntu updates. Would be possible to add patch to this problem to ubuntu (and also debian) updates?
| Michal (misosud) wrote | #1 |
| Seth Arnold (seth-arnold) wrote | #2 |
| information type: | Private Security → Public Security |
| Ubuntu Foundations Team Bug Bot (crichton) wrote | #3 |
| tags: | added: patch |
| Changed in poppler (Ubuntu): | |
| importance: | Undecided → Low |
| status: | New → Triaged |
| Michal (misosud) wrote | #4 |
Hello, I don't see much progress on the upstream bugs; do you know if progress has been reported elsewhere?
Thanks