Redmine

Exporting an issue to PDF never completes when the issue contains an image with explicit width/height attributes. The Ruby process stays busy in RBPDF text layout, its memory grows to several GB, and on our server several concurrent exports ended in a system-wide OOM kill.

This looks very similar to #36452, which was fixed in RBPDF 1.21.0, but we are running RBPDF 1.21.4.

Environment
Redmine 6.1.4
Ruby 3.4.10
Rails 7.2.3.2
RBPDF 1.21.4
Phusion Passenger 6.1.7 + nginx
Database: MySQL
Plugins: [TO COMPLETE, including redmine_ckeditor]
Reproduced without plugins: [YES / NO / NOT TESTED]
Steps to reproduce

1. Create an issue with a note containing an image with explicit dimensions wider than the page.

1. Export the issue to PDF (/issues/ID.pdf)

In our case the notes were written with the CKEditor plugin, which stores the image with an inline style setting the same width and height.

Expected result

The PDF is generated, the image being scaled to the page width (or skipped).

Actual result

The request never ends. On our production instance, one export ran for about 50 minutes before being killed, with very little database time and a very large GC time:

Completed in 3051801ms (ActiveRecord: 15.5ms (58 queries, 7 cached) | GC: 265517.7ms)

Each image of the issue logs the following error at the beginning of the export:

pdf: Image: error: wrong number of arguments (given 3, expected 0..2)

Removing the width/height attributes from the two images wider than the page makes the export complete almost instantly.

Backtrace of the busy thread (captured with SIGQUIT while looping)
rbpdf-1.21.4/lib/rbpdf.rb:16139:in 'RBPDF#setFontSubBuffer'
rbpdf-1.21.4/lib/rbpdf.rb:10332:in 'RBPDF#utf8Bidi'
rbpdf-1.21.4/lib/rbpdf.rb:3601:in 'RBPDF#getCellCode'
rbpdf-1.21.4/lib/rbpdf.rb:3395:in 'RBPDF#Cell'
rbpdf-1.21.4/lib/rbpdf.rb:4639:in 'RBPDF#Write'
rbpdf-1.21.4/lib/rbpdf.rb:14441:in 'RBPDF#writeHTML'
rbpdf-1.21.4/lib/rbpdf.rb:3924:in 'RBPDF#MultiCell'
rbpdf-1.21.4/lib/rbpdf.rb:13418:in 'RBPDF#writeHTMLCell'
lib/redmine/export/pdf.rb:95:in 'Redmine::Export::PDF::ITCPDF#RDMwriteFormattedCell'
lib/redmine/export/pdf/issues_pdf_helper.rb:231:in 'block in Redmine::Export::PDF::IssuesPdfHelper#issue_to_pdf'
lib/redmine/export/pdf/issues_pdf_helper.rb:217:in 'Array#each'
lib/redmine/export/pdf/issues_pdf_helper.rb:217:in 'Redmine::Export::PDF::IssuesPdfHelper#issue_to_pdf'
app/views/issues/show.pdf.erb:1

Notes

Only the two images declared at 1000px wide trigger the loop. Images declared at 600px and 700px in the same issue do not.
Removing the PNG alpha channel from the images did not change anything: the declared width is what matters.
The "wrong number of arguments" error when loading the images may be what prevents RBPDF from scaling them to the page, leaving the layout with no available width.