A SEGV DEADLYSIGNALflow leading to crash in split(GList*:TextOutputDev.cc:2626:7

[Asteriska001]

Description

A SEGV DEADLYSIGNALflow leading to crash.
The issue is being triggered in split(GList*:TextOutputDev.cc:2626:7

Environment

Ubuntu 18.04, 64bit

Reproduce

Command
git clone the Lastest Version firstly.
make && make install

asan

Config Error: No display font for 'Courier'
Config Error: No display font for 'Courier-Bold'
Config Error: No display font for 'Courier-BoldOblique'
Config Error: No display font for 'Courier-Oblique'
Config Error: No display font for 'Helvetica'
Config Error: No display font for 'Helvetica-Bold'
Config Error: No display font for 'Helvetica-BoldOblique'
Config Error: No display font for 'Helvetica-Oblique'
Config Error: No display font for 'Symbol'
Config Error: No display font for 'Times-Bold'
Config Error: No display font for 'Times-BoldItalic'
Config Error: No display font for 'Times-Italic'
Config Error: No display font for 'Times-Roman'
Config Error: No display font for 'ZapfDingbats'
Syntax Error: Couldn't read xref table
Syntax Warning: PDF file is damaged - attempting to reconstruct xref table...
Syntax Error (11741): Dictionary key must be a name object
Syntax Error (11744): Dictionary key must be a name object
Syntax Error (11748): Dictionary key must be a name object
Syntax Error (11752): Dictionary key must be a name object
Syntax Error (11756): Dictionary key must be a name object
Syntax Error (11760): Dictionary key must be a name object
Syntax Error (11764): Dictionary key must be a name object
Syntax Error (11768): Dictionary key must be a name object
Syntax Error (11772): Dictionary key must be a name object
Syntax Error (11776): Dictionary key must be a name object
Syntax Error (11780): Dictionary key must be a name object
Syntax Error (11784): Dictionary key must be a name object
Syntax Error (11788): Dictionary key must be a name object
Syntax Error (11790): Dictionary key must be a name object
Syntax Error (11806): Dictionary key must be a name object
Syntax Error (148): Unknown operator 'r0E'
Syntax Error (152): Too few (1) args to 'Td' operator
Syntax Error (162): Unknown operator 'r51T4'
Syntax Error (168): Unknown operator 'r51T4'
Syntax Error (170): Unknown operator 'f1'
Syntax Error (174): Too few (1) args to 'Tf' operator
Syntax Error (175): Unknown operator 'w63'
Syntax Error (179): Unknown operator 'f1'
Syntax Error (182): Unknown operator 'B360102'
Syntax Error (184): Unknown operator 'f1'
Syntax Error (190): Unknown operator 'T3.3'
Syntax Error (193): Unknown operator 'Q3.14f1'
Syntax Error (194): Unknown operator 'wF311'
Syntax Error (199): Illegal character '>'
Syntax Error (199): Unknown operator 'f1'
Syntax Error (201): Unknown operator 'A2.r3'
Syntax Error (206): Arg #0 to 'Tj' operator is wrong type (error)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4283==ERROR: AddressSanitizer: SEGV on unknown address 0x601c00023014 (pc 0x000000748592 bp 0x000080000000 sp 0x7ffe9082cfd0 T0)
==4283==The signal is caused by a WRITE memory access.
#0 0x748592 in TextPage::split(GList*, int) /AFLplusplus/my_test/pdftojson-master/xpdf/TextOutputDev.cc:2626:7
#1 0x73ab7d in TextPage::splitChars(GList*) /AFLplusplus/my_test/pdftojson-master/xpdf/TextOutputDev.cc:2481:14
#2 0x740962 in TextPage::makeColumns() /AFLplusplus/my_test/pdftojson-master/xpdf/TextOutputDev.cc:1498:10
#3 0x60c80e in JSONGen::convertPage(int, int (*)(void*, char const*, int), void*, int (*)(void*, char const*, int), void*, void*, int) /AFLplusplus/my_test/pdftojson-master/xpdf/JSONGen.cc:408:18
#4 0x78bb3e in main /AFLplusplus/my_test/pdftojson-master/xpdf/pdftojson.cc:199:24
#5 0x7fdf1391e0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
#6 0x41e6ed in _start (/AFLplusplus/my_test/pdftojson-master/tanuki/asan_bin/pdftojson+0x41e6ed)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /AFLplusplus/my_test/pdftojson-master/xpdf/TextOutputDev.cc:2626:7 in TextPage::split(GList*, int)
==4283==ABORTING

poc

000007.zip