bugThe FreeType Project - Bugs: bug #35689, Memory corruption in Move_Zp2_Point

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35689: Memory corruption in Move_Zp2_Point

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Fri 02 Mar 2012 09:26:45 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.9

Fri 02 Mar 2012 04:52:37 PM UTC, comment #4: 

An oversight.  Fixed now.

 Werner LEMBERG <wl>
Group administrator
Fri 02 Mar 2012 04:48:33 PM UTC, comment #3: 

By the way, is there any specific reason this bug hasn't became public once it's fixed?

 Mateusz Jurczyk <j00ru>
Group Member
Fri 02 Mar 2012 04:47:41 PM UTC, comment #2: 

Not a problem. I'll run some testing on the current git and if nothing shows up for a day or two, I'll be looking forward to the 2.4.9 release :)

 Mateusz Jurczyk <j00ru>
Group Member
Fri 02 Mar 2012 03:13:14 PM UTC, comment #1: 

Fixed in git.

Thanks a lot for your numerous reports!

 Werner LEMBERG <wl>
Group administrator
Fri 02 Mar 2012 09:26:45 AM UTC, original submission:  

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

I think it's the last issue I'm reporting to you for now, since I haven't been able to find any more crashes in a while.

Note: there seems to be two variants of the bug, one manifested in truetype/ttinterp.c:5706 and one in truetype/ttinterp.c:5699; the two lines are as follows:

 a) CUR.zp2.cur[point].x += dx;
 b) CUR.zp2.cur[point].y += dy;

The three attachments illustrate both issues. The vulnerability seems to corrupt the heap pretty badly, based on the Valgrind output.

Log from ASAN:

Load                      : =================================================================
==28842== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7f3a90812208 at pc 0x4bd3fa bp 0x7fff8e24a5d0 sp 0x7fff8e24a5c8
READ of size 8 at 0x7f3a90812208 thread T0
  #0 0x4bd3fa Move_Zp2_Point
  #1 0x4b459b Ins_SHC
  #2 0x4acb1a TT_RunIns
  #3 0x4cef19 TT_Hint_Glyph
  #4 0x4ce111 TT_Process_Composite_Glyph
  #5 0x4c92ba load_truetype_glyph
  #6 0x4c59cb TT_Load_Glyph
  #7 0x4893df FT_Load_Glyph
  #8 0x485c63 test_load
  #9 0x485a9e benchmark
  #10 0x4881c4 main
  #11 0x7f3a92c85d5d __libc_start_main
0x7f3a90812208 is located 8 bytes to the right of 8576-byte region [0x7f3a90810080,0x7f3a90812200)
allocated by thread T0 here:
  #0 0x5c6287 realloc
  #1 0x4a3b62 ft_mem_qrealloc
  #2 0x48bc3d ft_mem_realloc
  #3 0x48c1d3 FT_GlyphLoader_CheckPoints
  #4 0x4c13a2 TT_Load_Simple_Glyph
  #5 0x4c8129 load_truetype_glyph
  #6 0x4c59cb TT_Load_Glyph
  #7 0x4893df FT_Load_Glyph
  #8 0x485c63 test_load
  #9 0x485a9e benchmark
  #10 0x4881c4 main
  #11 0x7f3a92c85d5d __libc_start_main
==28842== ABORTING
Stats: 0M malloced (0M for red zones) by 759 calls
Stats: 0M realloced by 20 calls
Stats: 0M freed by 54 calls
Stats: 0M really freed by 0 calls
Stats: 40M (10246 full pages) mmaped in 10 calls
  mmaps   by size class: 8:16383; 9:8191; 10:4095; 11:2047; 12:1024; 13:512; 14:256; 15:128; 17:32; 19:8;
  mallocs by size class: 8:694; 9:25; 10:15; 11:12; 12:4; 13:3; 14:2; 15:2; 17:1; 19:1;
  frees   by size class: 8:28; 9:5; 10:10; 11:6; 12:2; 13:2; 19:1;
  rfrees  by size class:
Stats: malloc large: 2 small slow: 9
Shadow byte and word:
  0x1fe752102441: fa
  0x1fe752102440: fa fa fa fa fa fa fa fa
More shadow bytes:
  0x1fe752102420: 00 00 00 00 00 00 00 00
  0x1fe752102428: 00 00 00 00 00 00 00 00
  0x1fe752102430: 00 00 00 00 00 00 00 00
  0x1fe752102438: 00 00 00 00 00 00 00 00
=>0x1fe752102440: fa fa fa fa fa fa fa fa
  0x1fe752102448: fa fa fa fa fa fa fa fa
  0x1fe752102450: fa fa fa fa fa fa fa fa
  0x1fe752102458: fa fa fa fa fa fa fa fa
  0x1fe752102460: fa fa fa fa fa fa fa fa


Log from Valgrind:

==28912== Memcheck, a memory error detector
==28912== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==28912== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==28912== Command: ./ftbench tmp/freetype_run3/Andale_Mono.dfont.asan.3a.111
==28912==
tt_face_build_cmaps: broken cmap sub-table ignored
tt_face_build_cmaps: broken cmap sub-table ignored
Load                      : TT_Load_Simple_Glyph: too many instructions (2204)
TT_Load_Simple_Glyph: instruction count mismatch
TT_Load_Simple_Glyph: too many instructions (2111)
TT_Load_Simple_Glyph: too many instructions (2111)
TT_Load_Simple_Glyph: too many instructions (2111)
TT_Load_Simple_Glyph: too many instructions (2204)
TT_Load_Simple_Glyph: instruction count mismatch
TT_Load_Simple_Glyph: instruction count mismatch
TT_Load_Simple_Glyph: instruction count mismatch
==28912== Invalid read of size 8
==28912==    at 0x420AB6: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5706)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56bd738 is 8 bytes after a block of size 8,576 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405D79: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:224)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
==28912== Invalid write of size 8
==28912==    at 0x420ABE: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5706)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56bd738 is 8 bytes after a block of size 8,576 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405D79: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:224)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
==28912== Invalid read of size 1
==28912==    at 0x420AED: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5708)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56bd9e8 is 0 bytes after a block of size 536 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405DCE: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:225)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
==28912== Invalid write of size 1
==28912==    at 0x420AF3: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5708)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56bd9e8 is 0 bytes after a block of size 536 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405DCE: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:225)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
==28912== Invalid read of size 8
==28912==    at 0x420A3C: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5699)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56cb770 is not stack'd, malloc'd or (recently) free'd
==28912==
==28912== Invalid write of size 8
==28912==    at 0x420A43: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5699)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56cb770 is not stack'd, malloc'd or (recently) free'd
==28912==
==28912== Invalid read of size 1
==28912==    at 0x420A71: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5701)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56c1d90 is 0 bytes after a block of size 17,152 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405E3B: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:230)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
==28912== Invalid write of size 1
==28912==    at 0x420A77: Move_Zp2_Point (freetype2/src/truetype/ttinterp.c:5701)
==28912==    by 0x420DCB: Ins_SHC (freetype2/src/truetype/ttinterp.c:5817)
==28912==    by 0x424871: TT_RunIns (freetype2/src/truetype/ttinterp.c:7817)
==28912==    by 0x41CEB4: TT_Run_Context (freetype2/src/truetype/ttinterp.c:751)
==28912==    by 0x417599: TT_Hint_Glyph (freetype2/src/truetype/ttgload.c:793)
==28912==    by 0x41836F: TT_Process_Composite_Glyph (freetype2/src/truetype/ttgload.c:1178)
==28912==    by 0x4192FD: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1581)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==  Address 0x56c1d90 is 0 bytes after a block of size 17,152 alloc'd
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405E3B: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:230)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==
TT_Load_Simple_Glyph: instruction count mismatch
TT_Load_Simple_Glyph: too many instructions (45338)
TT_Load_Simple_Glyph: too many instructions (2111)

valgrind: m_mallocfree.c:267 (mk_plain_bszB): Assertion 'bszB != 0' failed.
valgrind: This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.

==28912==    at 0x3802F4C7: report_and_quit (coregrind/m_libcassert.c:210)
==28912==    by 0x3802F700: vgPlain_assert_fail (coregrind/m_libcassert.c:284)
==28912==    by 0x3803B298: unlinkBlock (coregrind/m_mallocfree.c:267)
==28912==    by 0x3803C2EF: vgPlain_arena_malloc (coregrind/m_mallocfree.c:1629)
==28912==    by 0x3800304B: vgMemCheck_realloc (memcheck/mc_malloc_wrappers.c:470)
==28912==    by 0x380739D5: do_client_request (coregrind/m_scheduler/scheduler.c:1513)
==28912==    by 0x380754A8: vgPlain_scheduler (coregrind/m_scheduler/scheduler.c:1184)
==28912==    by 0x3809EC49: run_a_thread_NORETURN (coregrind/m_syswrap/syswrap-linux.c:98)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==28912==    at 0x4C2A9BD: realloc (coregrind/m_replacemalloc/vg_replace_malloc.c:631)
==28912==    by 0x494478: ft_realloc (freetype2/src/base/ftsystem.c:107)
==28912==    by 0x413667: ft_mem_qrealloc (freetype2/src/base/ftutil.c:154)
==28912==    by 0x4134EB: ft_mem_realloc (freetype2/src/base/ftutil.c:101)
==28912==    by 0x405D79: FT_GlyphLoader_CheckPoints (freetype2/src/base/ftgloadr.c:224)
==28912==    by 0x41663B: TT_Load_Simple_Glyph (freetype2/src/truetype/ttgload.c:390)
==28912==    by 0x418B78: load_truetype_glyph (freetype2/src/truetype/ttgload.c:1394)
==28912==    by 0x419FA8: TT_Load_Glyph (freetype2/src/truetype/ttgload.c:2038)
==28912==    by 0x414DB1: tt_glyph_load (freetype2/src/truetype/ttdriver.c:334)
==28912==    by 0x4073F6: FT_Load_Glyph (freetype2/src/base/ftobjs.c:694)
==28912==    by 0x40177C: test_load (ft2demos-2.4.8/src/ftbench.c:221)
==28912==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==28912==    by 0x40274D: main (ft2demos-2.4.8/src/ftbench.c:794)


Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using.  Thanks.


Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #25238:  10220.13947.ttf.asan.7c.4 added by j00ru (327KiB - application/octet-stream)
file #25239:  Andale_Mono.dfont.asan.3a.111 added by j00ru (98KiB - application/octet-stream)
file #25240:  Tahoma.ttf.asan.3a.194 added by j00ru (303KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-03-02 wl PrivacyPrivate Public
    2012-03-02 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.9
    2012-03-02 j00ru Attached File- Added 10220.13947.ttf.asan.7c.4, #25238
        Attached File- Added Andale_Mono.dfont.asan.3a.111, #25239
        Attached File- Added Tahoma.ttf.asan.3a.194, #25240

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code