Bug 158015

Version:           kdegraphics3-pdf-3.5.7-60.3 (using KDE 3.5.7)
Installed from:    SuSE RPMs
Compiler:          gcc 4.2.1 openSUSE gcc RPM with name gcc-4.2-24
OS:                Linux

When running the following commands, kpdf crashes:

wget http://www.cse.ohio-state.edu/~qin/pub-papers/2006andbefore/asplos062-lu.pdf
kpdf asplos062-lu.pdf

Valgrind backtrace for the crash:

==5192== Thread 2:
==5192== Invalid read of size 1
==5192==    at 0xCFAFEC9: Splash::fillGlyph2(int, int, SplashGlyphBitmap*, int) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCFB114F: Splash::fillChar(double, double, int, SplashFont*) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF76FF7: SplashOutputDev::drawChar(GfxState*, double, double, double, double, double, double, unsigned, int, unsigned*, int) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF7FC36: Gfx::doShowText(GString*) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF80C7B: Gfx::opShowText(Object*, int) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF709D6: Gfx::go(int) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF70D2D: Gfx::display(Object*, int) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF86059: Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, Catalog*, int (*)(void*), void*) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCF86BD8: Page::display(OutputDev*, double, double, int, int, int, int, Catalog*, int (*)(void*), void*) (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0xCFD7ED3: PDFPixmapGeneratorThread::run() (in /opt/kde3/lib64/kde3/libkpdfpart.so)
==5192==    by 0x63A829A: QThreadInstance::start(void*) (in /usr/lib/qt3/lib64/libqt-mt.so.3.3.8)
==5192==    by 0x77AE01F: start_thread (in /lib64/libpthread-2.6.1.so)
==5192==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
KCrash: Application 'kpdf' crashing...
kpdf: Fatal IO error: client killed