From: joel@rac2.wam.umd.edu (Joel M. Hoffman) Subject: [KERNEL BUG?] GS reliably crashes Linux with the following input: Date: Wed, 26 May 1993 14:56:44 GMT
The following file was posted on one of the PostScript groups, and I
thought I'd give it a try, but it not only crashed Ghostscript, it
crashed my whole system! I couldn't even change VC's. I tried it
three times in a row, and got three crashes. I've never had any other
problems of this sort. I'm running GS version 2.6.0, kernel 0.99.8
with ipc and codepage patches on a Dell '386 with 387, at 25 MHz.
10Meg RAM and 16Meg swap.
I used the following command to print the file:
cat snowflake.ps | gs -sDEVICE=laserjet -r150 -sOutputFile="|/usr/bin/lpr" - &
The postscript file follows:
%!
%% Elizabeth D. Zwicky
%% zwicky@erg.sri.com
%% multiflake 2.0
% for predictability to make double sheets for earrings:
% 170492 srand
% for maximum randomness:
usertime srand
/seed rand def
/newflake {
/seed rand def
seed srand
/hue rand 999 mod 1000 div def
/strokecolor [hue 1000 mul cvi 3 mod dup 1 eq
{hue}
{2 eq
{rand 999 mod 1000 div}
{hue .5 add dup 1 gt {1 sub} if }
ifelse
}
ifelse
100 rand 85 mod sub 100 div
100 rand 55 mod sub 100 div] def
/fillcolor [ hue 1000 mul cvi 3 mod dup 1 eq
{hue}
{2 eq
{rand 999 mod 1000 div}
{hue .5 add dup 1 gt {1 sub} if }
ifelse
}
ifelse
100 rand 90 mod sub 100 div
100 rand 45 mod sub 20 add 100 div] def
/eofillcolor [ hue 1000 mul cvi 2 mod 1 eq
{hue}
{rand 999 mod 1000 div}
ifelse
rand 77 mod 22 add 100 div
90 rand 75 mod sub 15 add 100 div] def
/colorfill {fillcolor aload pop sethsbcolor fill } def
/colorstroke {strokecolor aload pop sethsbcolor stroke } def
/eocolorfill {eofillcolor aload pop sethsbcolor eofill } def
/arm { seed srand 0 0 moveto
repeats {
rand 4 mod 1 eq
{ x y lineto
rand 5 mod 1 eq
{x y lineto x y lineto}
{ x y x y x y curveto}
ifelse }
{ rand 4 mod 2 eq
{ x y x y x y curveto}
{ rand 4 mod 3 eq
{ x y lineto xarc yarc r ang ang arc}
{ x y x y x y curveto }
ifelse }
ifelse }
ifelse
} repeat
%% The following nasty and disgusting piece of arithmetic places a
%% point randomly on the imaginary line separating one sector of the
%% design from the next by picking a random x and then calculating a y
%% that's on that line. The disgustingess is partly caused by the lack of
%% a "tan". However, there's a lot of handwaving for legibility.
/alpha 90 360 narms div 2 div sub def
/tanalpha alpha sin 1 alpha sin alpha sin mul sub sqrt div def
%% tanalpha is also the slope.
/thisx xedge def
x y x y thisx tanalpha thisx mul curveto
seed srand
0 0 moveto
%% Exchange the comments to have a 50/50 chance of getting
%% rotational symmetry instead of reflectional symmetry
true {
% repeats 2 mod 1 eq {
repeats {
rand 4 mod 1 eq
{ x neg y lineto
rand 5 mod 1 eq
{x neg y lineto x neg y lineto}
{ x neg y x neg y x neg y curveto}
ifelse }
{ rand 4 mod 2 eq
{ x neg y x neg y x neg y curveto}
{ rand 4 mod 3 eq
{ x neg y lineto xarc neg yarc r 180 ang sub 180 ang sub arcn}
{ x neg y x neg y x neg y curveto }
ifelse }
ifelse }
ifelse
} repeat
/thisx xedge def
x neg y x neg y thisx neg tanalpha thisx mul curveto
}
{
% repeats {
rand 4 mod 3 eq
{ x neg y lineto
rand 5 mod 2 eq
{x neg y lineto x neg y lineto}
{ x neg y x neg y x neg y curveto}
ifelse }
{ repeats 4 mod 1 eq
{ x neg y x neg y x neg y curveto}
{ repeats 4 mod 2 eq
{ x neg y lineto xarc neg yarc r 180 ang sub 180 ang sub arcn}
{ x neg y x neg y x neg y curveto}
ifelse }
ifelse }
ifelse
% } repeat
}
ifelse
} def
newpath
0 0 moveto
boxsize 0 rlineto 0 boxsize rlineto boxsize neg 0 rlineto 0 0 lineto
hue
rand 99 mod 55 add 100 div
rand 99 mod 35 add 100 div
sethsbcolor fill
boxsize 2 div boxsize 2 div translate
/seed rand def
/maxrepeats boxsize 25 div cvi def
maxrepeats 3 gt {
/maxrepeats 3 def
} if
/repeats rand maxrepeats mod 1 add cvi def
/narms rand 7 mod 3 add cvi def
narms 4 eq
{/limit boxsize 2 div minim sub cvi def}
{/limit boxsize 2 div 45 sin mul minim sub cvi def}
ifelse
%% If the device you are using can handle complex fills, replace the
%% next three lines with:
%%
narms {arm 360 narms div rotate} repeat
gsave colorfill grestore gsave eocolorfill grestore colorstroke
%%
%% This will be not only faster, but prettier. On a LaserWriter or a
%% Tektronix Phaser II PS it gives a limitcheck. It only limit checks
%% every 10th or 11th snowflake on our Xerox 4700, and I can live with that.
%%narms {arm 360 narms div rotate colorfill} repeat
%%narms {arm 360 narms div rotate eocolorfill} repeat
%%narms {arm 360 narms div rotate} repeat colorstroke
} def
1 setlinewidth
clippath pathbbox /ury exch def /urx exch def /lly exch def /llx exch def
/minsize 150 def
/pagewidth urx llx sub def
/pageheight ury lly sub def
/inwidth pagewidth minsize div def
/inheight pageheight minsize div def
/boxsize
inwidth inheight gt
{pagewidth inwidth truncate div}
{pageheight inheight truncate div}
ifelse
def
/inwidth pagewidth boxsize div cvi def
/inheight pageheight boxsize div cvi def
/minim boxsize 10 div def
/x {rand limit mod minim add cvi dup 2 mod 0 eq {neg} if } def
/xarc { /r {rand boxsize 45 sin mul 4 div cvi mod 1 add} def
rand limit r sub cvi mod minim add cvi
dup 2 mod 0 eq {neg} if } def
/y {rand limit mod minim add cvi dup 2 mod 1 eq {neg} if} def
/yarc {
rand limit r sub cvi mod minim add cvi
dup 2 mod 1 eq {neg} if } def
/edgelimit { limit tanalpha div cvi } def
/xedge { rand edgelimit mod minim add cvi } def
/ang {rand 360 mod} def
llx lly translate
inheight {
inwidth {
gsave
newflake
grestore
boxsize 0 translate
} repeat
boxsize inwidth mul neg boxsize translate
} repeat
showpage
%% END OF POSTSCRIPT FILE (JMH)
--
=============================================================================
|_|~~ Germany, 1943. ``A little garden, fragrant and full of roses.
__|~| 16 Million DEAD. The path is narrow, and a little boy walks along it.
A little boy, a sweet boy, like that growing blossom,
cnc Bosnia, 1993. When the blossom comes to bloom,
cnc HOW MANY MORE? The little boy will be no more.''
- Franta Bass,
killed at age 14 by the Nazis
=============================================================================