bugThe FreeType Project - Bugs: bug #36386, NULL Pointer Dereference in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #36386: NULL Pointer Dereference in ps_parser_load_field_table

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Thu 03 May 2012 02:42:43 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.10

Mon 07 May 2012 08:49:17 PM UTC, comment #1: 

Fixed, thanks.

Werner LEMBERG <wl>
Group administrator
Thu 03 May 2012 02:42:43 PM UTC, original submission:  

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Valgrind crashlog:

==21625== Memcheck, a memory error detector
==21625== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==21625== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==21625== Command: ./ftbench 4866227948384084975.bin.SIGSEGV.e7d.86
==21625==
==21625== Invalid write of size 1
==21625==    at 0x50AFFC6: ps_parser_load_field_table (freetype2/src/psaux/psobjs.c:1275)
==21625==    by 0x50764D3: parse_dict (freetype2/src/type1/t1load.c:1016)
==21625==    by 0x50788C6: T1_Open_Face (freetype2/src/type1/t1load.c:2091)
==21625==    by 0x50792B7: T1_Face_Init (freetype2/src/type1/t1objs.c:339)
==21625==    by 0x505D637: open_face (freetype2/src/base/ftobjs.c:1153)
==21625==    by 0x505FDCF: FT_Open_Face (freetype2/src/base/ftobjs.c:2080)
==21625==    by 0x506105A: FT_New_Face (freetype2/src/base/ftobjs.c:1215)
==21625==    by 0x401587: get_face (ft2demos-2.4.9/src/ftbench.c:624)
==21625==    by 0x402408: main (ft2demos-2.4.9/src/ftbench.c:752)
==21625==  Address 0x2f8 is not stack'd, malloc'd or (recently) free'd
==21625==
==21625==
==21625== Process terminating with default action of signal 11 (SIGSEGV)
==21625==  Access not within mapped region at address 0x2F8
==21625==    at 0x50AFFC6: ps_parser_load_field_table (freetype2/src/psaux/psobjs.c:1275)
==21625==    by 0x50764D3: parse_dict (freetype2/src/type1/t1load.c:1016)
==21625==    by 0x50788C6: T1_Open_Face (freetype2/src/type1/t1load.c:2091)
==21625==    by 0x50792B7: T1_Face_Init (freetype2/src/type1/t1objs.c:339)
==21625==    by 0x505D637: open_face (freetype2/src/base/ftobjs.c:1153)
==21625==    by 0x505FDCF: FT_Open_Face (freetype2/src/base/ftobjs.c:2080)
==21625==    by 0x506105A: FT_New_Face (freetype2/src/base/ftobjs.c:1215)
==21625==    by 0x401587: get_face (ft2demos-2.4.9/src/ftbench.c:624)
==21625==    by 0x402408: main (ft2demos-2.4.9/src/ftbench.c:752)
==21625==  If you believe this happened as a result of a stack
==21625==  overflow in your program's main thread (unlikely but
==21625==  possible), you can try to increase the size of the
==21625==  main thread stack using the --main-stacksize= flag.
==21625==  The main thread stack size used in this run was 8388608.
==21625==
==21625== HEAP SUMMARY:
==21625==     in use at exit: 23,732 bytes in 46 blocks
==21625==   total heap usage: 48 allocs, 2 frees, 25,236 bytes allocated
==21625==
==21625== LEAK SUMMARY:
==21625==    definitely lost: 0 bytes in 0 blocks
==21625==    indirectly lost: 0 bytes in 0 blocks
==21625==      possibly lost: 0 bytes in 0 blocks
==21625==    still reachable: 23,732 bytes in 46 blocks
==21625==         suppressed: 0 bytes in 0 blocks
==21625== Rerun with --leak-check=full to see details of leaked memory
==21625==
==21625== For counts of detected and suppressed errors, rerun with: -v
==21625== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #25773:  4866227948384084975.bin.SIGSEGV.e7d.86 added by j00ru (34KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-05-07 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.10
    2012-05-03 j00ru Attached File- Added 4866227948384084975.bin.SIGSEGV.e7d.86, #25773

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code