bugThe FreeType Project - Bugs: bug #30082, SIGSEGV while loading one of the...

 
 

bug #30082: SIGSEGV while loading one of the glyphs (in freetype2/src/cff/cffgload.c)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Tue 08 Jun 2010 02:57:09 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 09 Jun 2010 07:15:29 AM UTC, comment #1:

Fixed, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 08 Jun 2010 02:57:09 PM UTC, original submission:

git sources as of 2010-06-08
Linux amd64, gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)

http://alt.swiecki.net/j/f/sigsegv4.ttf

It can be observed with ftbench

(gdb) r -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Starting program: /usr/local/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Load :
Program received signal SIGSEGV, Segmentation fault.
0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
314 glyph->root.outline = *builder->base;
(gdb) p glyph
$1 = (CFF_GlyphSlot) 0x60000
(gdb) x/x glyph
0x60000: Cannot access memory at address 0x60000
(gdb) bt
#0 0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
#1 0x00000000004363d4 in cff_slot_load (glyph=0x6d0150, size=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffgload.c:2764
#2 0x000000000042bee7 in Load_Glyph (cffslot=0x6d0150, cffsize=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffdrivr.c:182
#3 0x0000000000405a52 in FT_Load_Glyph (face=0x6ada60, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/base/ftobjs.c:677
#4 0x00000000004017c4 in test_load (timer=0x7fffffffe230, face=0x6ada60, user_data=0x0) at /usr/local/src/freetype2-demos/src/ftbench.c:218
#5 0x00000000004016fe in benchmark (face=0x6ada60, test=0x7fffffffe2a0, max_iter=1, max_time=2) at /usr/local/src/freetype2-demos/src/ftbench.c:188
#6 0x000000000040275f in main (argc=1, argv=0x7fffffffe410) at /usr/local/src/freetype2-demos/src/ftbench.c:781

The glyph_index is 1718, so the rest of the viewers (ftview, ftstring) will not crash by default, as they don't use such big indexes (maybe I just need to force them to display more characters).

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 09 Jun 2010 07:15:29 AM UTCwlAssigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Wed 09 Jun 2010 07:15:28 AM UTCwlStatusNone=>Fixed

    Back to the top


    Powered by Savane 3.1-cleanup