On Debian systems, extra libraries have to be copied to the systemplate chroot, namely /usr/lib/$TRIPLET/nss/*.so and /usr/lib/$TRIPLET/libsqlite3.so.* (where $TRIPLET is the architecture triplet, typically "x86_64-linux-gnu"). These libraries don't show up in `ldd /path/to/xpdfimport`, but omitting them in the chroot (partially) breaks NSS. In particular, exporting a document to PDF, either directly in LOOL or using its API with `curl -F data=@/path/to/doc.odt http://127.0.0.1:9980/lool/convert-to/pdf`, causes loolforkit to segfault. AFAICT from a debug trace, this is because the PDF writer calls ::comphelper::Hash which in turns triggers a null pointer dereference in libnss's HASH_Begin. Making loolwsd-systemplate-setup copy these libraries to the chroot fixed the PDF export issue on our instance. The problem might be Debian-specific as RedHat-based distros don't have that "nss" sub-directory (instead libfreebl3.so and friends are copied directly in /lib; not sure if on these systems the chroot has a crippled libnss or not). System info: LOOLWSD 6.1.3, LOKit 6.1.3.2
What Debian system is that? One of my LibreOffice Online servers is a Debian 9 and it does not have /usr/lib/x86_64-linux-gnu/nss/. I tried to export PDF and it worked.
Debian 9.6 (codename Stretch), packaged LibreOffice and LOKit from stretch-backports (1:6.1.3-1~bpo9+2). /usr/lib/x86_64-linux-gnu/nss/*.so are owned by libnss3 2:3.26.2-1.1+deb9u1. $ dpkg -S /usr/lib/x86_64-linux-gnu/nss/*.so libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libfreebl3.so libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libfreeblpriv3.so libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libnssdbm3.so libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libsoftokn3.so The directory is installed on all releases since jessie (on amd64 at least, didn't check other archs): https://packages.debian.org/jessie/amd64/libnss3/filelist https://packages.debian.org/stretch/amd64/libnss3/filelist https://packages.debian.org/buster/amd64/libnss3/filelist https://packages.debian.org/sid/amd64/libnss3/filelist libnss3 is "Priority: optional" so you might not have it installed, but the libreoffice-* packages depend on it. $ apt-cache rdepends libnss3 | grep libreoffice libreoffice-sdbc-postgresql libreoffice-core libreoffice-sdbc-postgresql libreoffice-core
Even if only users of the official Debian packages from stretch backports are affected, I guess it doesn't hurt to try to copy these into the chroot. (The script looks for stuff that doesn't exist on my system already.)
I indeed forgot to mention in the original report that we were using the LibreOffice packages from stretch-backports, sorry. I guess you're using something else on your Debian 9 system? Which perhaps uses OpenSSL's EVP not NSS to calculate the PDF digest?
OK, so the bug occurs when LibreOffice is built with system NSS.
Andras Timar committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/online/+/9606c29d64bc7526a4a65848613b8ee288936ed2%5E%21 tdf#121429 PDF writing needs NSS libs in systemplate
Andras Timar committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/online/+/052c033e920cf6906a9e0c9b27381b2ae234f231%5E%21 tdf#121429 PDF writing needs NSS libs in systemplate (2)
Andras Timar committed a patch related to this issue. It has been pushed to "libreoffice-6-2": https://git.libreoffice.org/online/+/b58c2b75f516f39fdf6ba9a63227836415c6bcf9%5E%21 tdf#121429 PDF writing needs NSS libs in systemplate
Andras Timar committed a patch related to this issue. It has been pushed to "libreoffice-6-1": https://git.libreoffice.org/online/+/ae005d654c4b2304e41231b76ccd08ebc27ca55c%5E%21 tdf#121429 PDF writing needs NSS libs in systemplate