bugThe FreeType Project - Bugs: bug #30135, NULL-ptr deref in bdf/bdflib.c -...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30135: NULL-ptr deref in bdf/bdflib.c - bdf font

Submitter:  Robert Swiecki <jagger>
Submitted:  Tue 15 Jun 2010 01:09:11 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.3.13

Sat 19 Jun 2010 02:09:31 PM UTC, comment #3: 

Fixed in git.  Thanks for the report.

Werner LEMBERG <wl>
Group administrator
Tue 15 Jun 2010 01:14:24 PM UTC, comment #2: 

And line 3832 of the file contains the following content:

$ grep -n STARTCHAR SIGSEGV.PC.0x808301c.CODE.2.ADDR.0x80b9a54.INSTR.mov_[eax],_0x00.TIME.2010-06-15.14.56.06.PID.23354.ttf | grep 3832 | cut -f2 -d: | xxd
5354 4152 5443 4841 5220 0a

So instead of

"STARTCHAR <x>horn"

it's

"STARTCHAR "
"horn"

Robert Swiecki <jagger>
Tue 15 Jun 2010 01:10:06 PM UTC, comment #1: 

And stacktrace

(gdb) bt
#0  0x0808301c in _bdf_list_join (list=0x80d50a0, c=32, alen=0xffffd384) at /usr/local/google/src/freetype2/src/bdf/bdflib.c:497
#1  0x0808486e in _bdf_parse_glyphs (line=0x80d51f3 "STARTCHAR", linelen=10, lineno=3832, call_data=0xffffd41c, client_data=0x80d3078) at /usr/local/google/src/freetype2/src/bdf/bdflib.c:1547
#2  0x080835d1 in _bdf_readstream (stream=0x80d2dd0, callback=0x8085829 <_bdf_parse_start>, client_data=0x80d3078, lno=0xffffd45c) at /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
#3  0x0808613d in bdf_load_font (stream=0x80d2dd0, extmemory=0x80ce008, opts=0xffffd4a0, font=0xffffd4d8) at /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
#4  0x08086f4a in BDF_Face_Init (stream=0x80d2dd0, bdfface=0x80d2e00, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
#5  0x0804d0c6 in open_face (driver=0x80d2980, stream=0x80d2dd0, face_index=0, num_params=0, params=0x0, aface=0xffffd5a8) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
#6  0x0804e331 in FT_Open_Face (library=0x80ce020, args=0xffffd5e0, face_index=0, aface=0xffffd6bc) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
#7  0x0804d1bb in FT_New_Face (library=0x80ce020, pathname=0xffffd939 "SIGSEGV.PC.0x808301c.CODE.2.ADDR.0x80b9a54.INSTR.mov_[eax],_0x00.TIME.2010-06-15.14.56.06.PID.23354.ttf", face_index=0, aface=0xffffd6bc)
    at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#8  0x08049995 in get_face (face=0xffffd6bc) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#9  0x08049c5b in main (argc=1, argv=0xffffd780) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739

Robert Swiecki <jagger>
Tue 15 Jun 2010 01:09:11 PM UTC, original submission:  

git sources as of Jun 2010-06-12

Font: http://alt.swiecki.net/j/f/sigsegv7.bdf

gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) - library and tools compiled with -m32 -O0

$ gdb ./ftbench
(gdb) r -c 1 SIGSEGV.PC.0x808301c.CODE.2.ADDR.0x80b9a54.INSTR.mov_[eax],_0x00.TIME.2010-06-15.14.56.06.PID.23354.ttf
Program received signal SIGSEGV, Segmentation fault.
0x0808301c in _bdf_list_join (list=0x80d50a0, c=32, alen=0xffffd384) at /usr/local/google/src/freetype2/src/bdf/bdflib.c:497
497     dp[j] = 0;
(gdb) p/x dp
$1 = 0x80b9a74
(gdb) x/x dp
0x80b9a74 <empty>: 0x00000000


valgrind:
==27635== Command: ./ftbench -c 1 SIGSEGV.PC.0x808301c.CODE.2.ADDR.0x80b9a54.INSTR.mov_[eax],_0x00.TIME.2010-06-15.14.56.06.PID.23354.ttf
==27635==
==27635== Invalid read of size 8
==27635==    at 0x6C91455: __strlen_sse2 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/strlen.S:87
==27635==    by 0x8085E2C: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2149
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d86be0 is 8 bytes before a block of size 58 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x8085DE6: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2143
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==
==27635== Invalid read of size 8
==27635==    at 0x6C9149D: __strlen_sse2 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/strlen.S:118
==27635==    by 0x8085E2C: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2149
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d86c20 is 56 bytes inside a block of size 58 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x8085DE6: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2143
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==
==27635== Invalid read of size 8
==27635==    at 0x6D30039: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:866
==27635==    by 0x8085E2C: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2149
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d86be0 is 8 bytes before a block of size 58 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x8085DE6: _bdf_parse_start /usr/local/google/src/freetype2/src/bdf/bdflib.c:2143
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==
==27635== Invalid read of size 8
==27635==    at 0x6D379E4: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/strcmp-ssse3.S:142
==27635==    by 0x8082D96: hash_lookup /usr/local/google/src/freetype2/src/bdf/bdflib.c:322
==27635==    by 0x8084167: _bdf_add_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:1316
==27635==    by 0x808572B: _bdf_parse_properties /usr/local/google/src/freetype2/src/bdf/bdflib.c:1954
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d87048 is 8 bytes inside a block of size 12 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x8083AF9: bdf_create_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:998
==27635==    by 0x8084142: _bdf_add_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:1313
==27635==    by 0x808572B: _bdf_parse_properties /usr/local/google/src/freetype2/src/bdf/bdflib.c:1954
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==
==27635== Invalid read of size 8
==27635==    at 0x6D379ED: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/strcmp-ssse3.S:144
==27635==    by 0x8082D96: hash_lookup /usr/local/google/src/freetype2/src/bdf/bdflib.c:322
==27635==    by 0x8084167: _bdf_add_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:1316
==27635==    by 0x808572B: _bdf_parse_properties /usr/local/google/src/freetype2/src/bdf/bdflib.c:1954
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d87050 is 4 bytes after a block of size 12 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x8083AF9: bdf_create_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:998
==27635==    by 0x8084142: _bdf_add_property /usr/local/google/src/freetype2/src/bdf/bdflib.c:1313
==27635==    by 0x808572B: _bdf_parse_properties /usr/local/google/src/freetype2/src/bdf/bdflib.c:1954
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==
==27635== Invalid read of size 4
==27635==    at 0x6D3BE7C: __memcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcmp-ssse3.S:1941
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d8088d is 1,021 bytes inside a block of size 1,024 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x80833A5: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:633
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==
==27635== Invalid read of size 4
==27635==    at 0x6D3BD1E: __memcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcmp-ssse3.S:1804
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d8088d is 1,021 bytes inside a block of size 1,024 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x80833A5: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:633
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==
==27635== Invalid read of size 4
==27635==    at 0x6D3BC6E: __memcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcmp-ssse3.S:1743
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==  Address 0x6d8088d is 1,021 bytes inside a block of size 1,024 alloc'd
==27635==    at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27635==    by 0x80B3940: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27635==    by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27635==    by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27635==    by 0x8055005: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:145
==27635==    by 0x8054F23: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==27635==    by 0x80833A5: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:633
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==
==27635==
==27635== Process terminating with default action of signal 11 (SIGSEGV)
==27635==  Bad permissions for mapped region at address 0x80B9A74
==27635==    at 0x808301C: _bdf_list_join /usr/local/google/src/freetype2/src/bdf/bdflib.c:497
==27635==    by 0x808486D: _bdf_parse_glyphs /usr/local/google/src/freetype2/src/bdf/bdflib.c:1547
==27635==    by 0x80835D0: _bdf_readstream /usr/local/google/src/freetype2/src/bdf/bdflib.c:720
==27635==    by 0x808613C: bdf_load_font /usr/local/google/src/freetype2/src/bdf/bdflib.c:2249
==27635==    by 0x8086F49: BDF_Face_Init /usr/local/google/src/freetype2/src/bdf/bdfdrivr.c:366
==27635==    by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27635==    by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27635==    by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27635==    by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27635==    by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27635==
==27635== HEAP SUMMARY:
==27635==     in use at exit: 97,348 bytes in 551 blocks
==27635==   total heap usage: 576 allocs, 25 frees, 105,236 bytes allocated
==27635==
==27635== LEAK SUMMARY:
==27635==    definitely lost: 0 bytes in 0 blocks
==27635==    indirectly lost: 0 bytes in 0 blocks
==27635==      possibly lost: 0 bytes in 0 blocks
==27635==    still reachable: 97,348 bytes in 551 blocks
==27635==         suppressed: 0 bytes in 0 blocks

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #20754:  sigsegv7.bdf added by jagger (146KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-19 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.13
    2010-06-15 jagger Attached File- Added sigsegv7.bdf, #20754

    Back to the top

    Powered by Savane 3.13-ee12.
    Corresponding source code