bugThe FreeType Project - Bugs: bug #30106, Invalid free (heap corruption?)...

 
 

bug #30106: Invalid free (heap corruption?) resulting in SIGABRT (via glibc MALLOC_CHECK_=3)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 10 Jun 2010 06:49:30 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 12 Jun 2010 12:10:41 AM UTC, comment #2:

Both glibc and valgrind are happy, thanks ;)

Robert Swiecki <jagger>
Fri 11 Jun 2010 11:34:29 PM UTC, comment #1:

This was tricky. Fixed now in the git repository. Please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 10 Jun 2010 06:49:30 PM UTC, original submission:

git sources as of 2010-06-10, gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), 32bit (compiled with -m32).

http://alt.swiecki.net/j/f/sigabrt2.ttf

It might be somehow related to #30082 (the same function). Please test it with

MALLOC_CHECK_=3

I attached valgrind report as well.

$ MALLOC_CHECK_=3 gdb ./ftbench
GNU gdb (GDB) 7.1-gg4
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
Type "show copying" and "show warranty" for licensing/warranty details.
This GDB was configured as "x86_64-linux".

Reading symbols from /usr/local/google/fuzz/ttf/ftbench...done.
(gdb) r -c 1 SIGABRT.PC.0xf7fdf430.CODE.-6.ADDR.0x11020000078a6.INSTR.pop_ebp.TIME.2010-06-10.20.08.01.PID.30886.ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 SIGABRT.PC.0xf7fdf430.CODE.-6.ADDR.0x11020000078a6.INSTR.pop_ebp.TIME.2010-06-10.20.08.01.PID.30886.ttf
warning: the debug information found in "/lib/ld-2.11.1.so" does not match "/lib/ld-linux.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//lib/ld-2.11.1.so" does not match "/lib/ld-linux.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug/lib/ld-2.11.1.so" does not match "/lib/ld-linux.so.2" (CRC mismatch).

Load : ftbench: malloc.c:4954: _int_free: Assertion `nextchunk->fd_nextsize->bk_nextsize == nextchunk' failed.

Program received signal SIGABRT, Aborted.
0xf7fdf430 in __kernel_vsyscall ()
(gdb) bt
#0 0xf7fdf430 in __kernel_vsyscall ()
#1 0xf7e8e921 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2 0xf7e91d52 in *__GI_abort () at abort.c:92
#3 0xf7ed0434 in __malloc_assert (assertion=<value optimized out>, file=<value optimized out>, line=4954, function=0xf7f96e2d "_int_free") at malloc.c:352
#4 0xf7ed1d22 in _int_free (av=<value optimized out>, p=0x80d8418) at malloc.c:4954
#5 0xf7ed1f0e in free_check (mem=0x80d8420, caller=0x80b3952) at hooks.c:300
#6 0xf7ed4c06 in *__GI___libc_free (mem=0x6) at malloc.c:3699
#7 0x080b3952 in ft_free (memory=0x80ce008, block=0x80d8420) at builds/unix/ftsystem.c:158
#8 0x08055088 in ft_mem_free (memory=0x80ce008, P=0x80d8420) at /usr/local/google/src/freetype2/src/base/ftutil.c:171
#9 0x0809d208 in psh_glyph_done (glyph=0xffffcea0) at /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1146
#10 0x0809ecb1 in ps_hints_apply (ps_hints=0x80d2b3c, outline=0x80d6c20, globals=0x80d6d30, hint_mode=FT_RENDER_MODE_NORMAL) at /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2295
#11 0x08073367 in cff_decoder_parse_charstrings (decoder=0xffffd0cc,
charstring_base=0xf7e24224 "\367~\n\367Hw\022\255\367\021\221\367\024\023\370\063\035\023\364\332\367\065\367\017\016\367~\n\330\312\001\255\367\021\003\063\035<\367C\205\035\063\373`\314\320\023\342Kv\367p\370\311\035\022\255\367\021\220\334\023\\\370(\367\005\025ngh\202c\033bk\227\245s\372F\n\177\255\212\246\b\220\370\235\n\315\371\377\035\224\247\225\216\214\217\234\212\372O\n\203\371\261\nÂe\341 \033e^\177\372\033\nUjcL;\032\023<K\235O\264d\036\023\272\371\375\nz\304\033\224\224\214\214\225\037`k]Zc\370u\n\247\037\023Z\242\231\267\271\257\036\262\232\255\246\246\253\214\216\216\234\212\223\b\023\\\216\210\215\212\036\373R\367\232\025\261\240YL\216\037"..., charstring_len=25)
at /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
#12 0x08074189 in cff_slot_load (glyph=0x80d6b00, size=0x80d6c50, glyph_index=714, load_flags=0) at /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
#13 0x0806bd5e in Load_Glyph (cffslot=0x80d6b00, cffsize=0x80d6c50, glyph_index=714, load_flags=0) at /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
#14 0x0804c923 in FT_Load_Glyph (face=0x80d2e70, glyph_index=714, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#15 0x0804904c in test_load (timer=0xffffd618, face=0x80d2e70, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:218
#16 0x08048fab in benchmark (face=0x80d2e70, test=0xffffd668, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:188
#17 0x08049dd2 in main (argc=1, argv=0xffffd770) at /usr/local/google/src/freetype2-demos/src/ftbench.c:781

$ valgrind --leak-check=full ./ftbench -c 1 "SIGABRT.PC.0xf7fdf430.CODE.-6.ADDR.0x11020000078a6.INSTR.pop_ebp.TIME.2010-06-10.20.08.01.PID.30886.ttf"
VALGRIND_MEMORY_LIMIT_IN_MB=4095; VALGRIND_TIMEOUT=3600
==3307== Memcheck, a memory error detector
==3307== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==3307== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==3307== Command: ./ftbench -c 1 SIGABRT.PC.0xf7fdf430.CODE.-6.ADDR.0x11020000078a6.INSTR.pop_ebp.TIME.2010-06-10.20.08.01.PID.30886.ttf
==3307==
Load : ==3307== Invalid read of size 4
==3307== at 0x809DAA7: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1529
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057ec4 is 12 bytes before a block of size 16 alloc'd
==3307== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==3307== by 0x80B3924: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==3307== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==3307== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==3307== by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==3307== by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==3307== by 0x809D4AF: psh_glyph_init /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1274
==3307== by 0x809EA3B: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2212
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307==
==3307== Invalid read of size 4
==3307== at 0x809DAB0: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1532
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb0 is not stack'd, malloc'd or (recently) free'd
==3307==
==3307== Invalid read of size 1
==3307== at 0x809DAC1: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1535
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb4 is not stack'd, malloc'd or (recently) free'd
==3307==
==3307== Invalid read of size 1
==3307== at 0x809DAD0: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1535
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb4 is not stack'd, malloc'd or (recently) free'd
==3307==
==3307== Invalid read of size 1
==3307== at 0x809DAF2: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1538
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb5 is not stack'd, malloc'd or (recently) free'd
==3307==
==3307== Invalid read of size 1
==3307== at 0x809DB01: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1538
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb5 is not stack'd, malloc'd or (recently) free'd
==3307==
==3307== Invalid read of size 4
==3307== at 0x809DC41: psh_hint_table_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1586
==3307== by 0x809DF20: psh_glyph_find_strong_points /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:1710
==3307== by 0x809EBFC: ps_hints_apply /usr/local/google/src/freetype2/src/pshinter/pshalgo.c:2276
==3307== by 0x8073366: cff_decoder_parse_charstrings /usr/local/google/src/freetype2/src/cff/cffgload.c:1977
==3307== by 0x8074188: cff_slot_load /usr/local/google/src/freetype2/src/cff/cffgload.c:2730
==3307== by 0x806BD5D: Load_Glyph /usr/local/google/src/freetype2/src/cff/cffdrivr.c:182
==3307== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==3307== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==3307== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==3307== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==3307== Address 0x7057eb0 is not stack'd, malloc'd or (recently) free'd
==3307==
1083.170 us/op
Load_Advances (Normal) : 1.858 us/op
Load_Advances (Fast) : 1.105 us/op
Render : 311.374 us/op
Get_Glyph : 60.550 us/op
Get_CBox : 16.002 us/op
Get_Char_Index : 4.249 us/op
Iterate CMap : 2052.069 us/op
New_Face : 25424.004 us/op
Embolden : 2.694 us/op
==3307==
==3307== HEAP SUMMARY:
==3307== in use at exit: 0 bytes in 0 blocks
==3307== total heap usage: 129,002 allocs, 129,002 frees, 68,738,317 bytes allocated
==3307==
==3307== All heap blocks were freed -- no leaks are possible
==3307==
==3307== For counts of detected and suppressed errors, rerun with: -v
==3307== ERROR SUMMARY: 60 errors from 7 contexts (suppressed: 13 from 0)

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 11 Jun 2010 11:34:29 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13

    Back to the top


    Powered by Savane 3.1-cleanup