bugThe FreeType Project - Bugs: bug #33992, heap underflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #33992: heap underflow in ft_stroke_border_close

Submitter:  None
Submitted:  Thu 11 Aug 2011 08:09:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.7

Mon 15 Aug 2011 03:37:07 PM UTC, comment #3: 

Applied, thanks!

Werner LEMBERG <wl>
Group administrator
Mon 15 Aug 2011 03:05:19 PM UTC, comment #2: 

Werner,

The following is preferable to fix this:

--- old\ftstroke.c Sat Jul 02 11:37:30 2011
+++ new\ftstroke.c Mon Aug 15 15:46:29 2011
@@ -2222,9 +2222,13 @@
       if ( error )
         goto Exit;
 
-      error = FT_Stroker_EndSubPath( stroker );
-      if ( error )
-        goto Exit;
+      /* don't try to end the path if no segments have been generated */
+      if ( !stroker->first_point )
+      {
+        error = FT_Stroker_EndSubPath( stroker );
+        if ( error )
+          goto Exit;
+      }
 
       first = last + 1;
     }


Thanks.

David %^>

David Bevan <davidbevan>
Fri 12 Aug 2011 06:54:41 AM UTC, comment #1: 

David, please check the bug fix.

Werner LEMBERG <wl>
Group administrator
Thu 11 Aug 2011 08:09:09 PM UTC, original submission:  

At small zoom levels, border->start in ft_stroke_border_close can wrongly be -1, leading to a heap underflow at line 364 in ftstroke.c . This happens whenever stroker->first_point is TRUE in FT_Stroker_EndSubPath (which seems to happen at very small zoom levels).

Reliably reproduced with FreeType 2.4.6 as configured at http://code.google.com/p/sumatrapdf/source/browse/trunk#trunk%2Fext%2Ffreetype2 and with http://www.jaycar.com.au/images_uploaded/dcdcconv.pdf (http://code.google.com/p/sumatrapdf/source/detail?r=4365 fixes the crash for us).

If you need further information, feel free to contact me at -email is unavailable- .

BTW: This is likely the same issue as reported at http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg929267.html and https://bugs.archlinux.org/task/25332

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by davidbevan (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by wl
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-08-15 wl StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.7
    2011-08-12 wl StatusNone In Progress
        Assigned toNone wl
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code