bugThe FreeType Project - Bugs: bug #19260, Crash while rendering composite...

 
 

bug #19260: Crash while rendering composite glyphs using incremental memory interface in version 2.3.0

Submitted by:  Martin Horak <horakm>
Submitted on:  Fri 09 Mar 2007 04:21:05 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 09 Apr 2007 08:40:52 AM UTC, comment #5:

I've applied your patch to the CVS. Thanks.

Please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 10 Mar 2007 10:29:09 AM UTC, comment #4:

static FT_Error
load_truetype_glyph( TT_Loader loader,
FT_UInt glyph_index,
FT_UInt recurse_count )
{
FT_Error error;
FT_Fixed x_scale, y_scale;
FT_ULong offset;
TT_Face face = (TT_Face)loader->face;
FT_GlyphLoader gloader = loader->gloader;
FT_Bool opened_frame = 0;

#ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
FT_Vector* deltas = NULL;
#endif

#ifdef FT_CONFIG_OPTION_INCREMENTAL

//*** local stream variable
FT_StreamRec inc_stream;
FT_Data glyph_data;
FT_Bool glyph_data_loaded = 0;
#endif

...

#ifdef FT_CONFIG_OPTION_INCREMENTAL

/* If we are loading glyph data via the incremental interface, set */
/* the loader stream to a memory stream reading the data returned */
/* by the interface. */
if ( face->root.internal->incremental_interface )
{
error = face->root.internal->incremental_interface->funcs->get_glyph_data(
face->root.internal->incremental_interface->object,
glyph_index, &glyph_data );
if ( error )
goto Exit;

glyph_data_loaded = 1;
offset = 0;
loader->byte_len = glyph_data.length;

FT_MEM_ZERO( &inc_stream, sizeof ( inc_stream ) );
FT_Stream_OpenMemory( &inc_stream,
glyph_data.pointer, glyph_data.length );

//*** storing pointer to local variable
loader->stream = &inc_stream;
}
else

#endif /* FT_CONFIG_OPTION_INCREMENTAL */

...

//*** loader->stream points to local variable when function returns

Martin Horak <horakm>
Sat 10 Mar 2007 07:09:14 AM UTC, comment #3:

When using stream interface, new variable of type FT_StreamRec appears in function load_truetype_glyph. When this function returns, a pointer to this local variable is stored in loader structure. This pointer is no longer valid after the function returns.

Martin Horak <horakm>
Sat 10 Mar 2007 06:03:32 AM UTC, comment #2:

Please forget my last comment regarding HelveticaNeue-Bold;
I apparently mixed up FreeType versions, and the bug with
this particular font has nothing to do with your change.

Having a debuggable code snippet would be still
advantageous...

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 09 Mar 2007 09:36:50 PM UTC, comment #1:

This fix is not correct, unfortunately -- normal
rendering of fonts yields distorted glyphs, for example
with HelveticaNeue-Bold.

Please provide a small code example which compiles,
and which demonstrates the crash.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 09 Mar 2007 04:21:05 PM UTC, original submission:

Hello,
I have experiencing issue while rendering composite glyghs using incremental memory interface and using bytecode interpreter. The problem occurs while calling function TT_Process_Composite_Glyph from function load_truetype_glyph which acessing to a memory stream. In my opinion, the memory stream becomes invalid because is replaced by another stream which is stored on stack by function load_truetype_glyph called in loop. I have changed the code to save and restore previous memory stream and it seems to solve the problem. Below is the modified code fragment with comments.
Regards,

Martin

/*********************************************************************/
/*********************************************************************/
/*********************************************************************/

{
FT_UInt n, num_base_points;
FT_SubGlyph subglyph = 0;

FT_UInt num_points = start_point;
FT_UInt num_subglyphs = gloader->current.num_subglyphs;
FT_UInt num_base_subgs = gloader->base.num_subglyphs;

//***save current stream
FT_StreamRec *oldinc_stream = loader->stream;

FT_GlyphLoader_Add( gloader );

/* read each subglyph independently */
for ( n = 0; n < num_subglyphs; n++ )
{
FT_Vector pp[4];

/* Each time we call load_truetype_glyph in this loop, the */
/* value of `gloader.base.subglyphs' can change due to table */
/* reallocations. We thus need to recompute the subglyph */
/* pointer on each iteration. */
subglyph = gloader->base.subglyphs + num_base_subgs + n;

pp[0] = loader->pp1;
pp[1] = loader->pp2;
pp[2] = loader->pp3;
pp[3] = loader->pp4;

num_base_points = gloader->base.outline.n_points;

//***calling function below caused overwriting current stream interface by another which was stored on destroyed stack

error = load_truetype_glyph( loader, subglyph->index,
recurse_count + 1 );
if ( error )
goto Exit;

/* restore subglyph pointer */
subglyph = gloader->base.subglyphs + num_base_subgs + n;

if ( !( subglyph->flags & USE_MY_METRICS ) )
{
loader->pp1 = pp[0];
loader->pp2 = pp[1];
loader->pp3 = pp[2];
loader->pp4 = pp[3];
}

num_points = gloader->base.outline.n_points;

if ( num_points == num_base_points )
continue;

/* gloader->base.outline consists of three part: */
/* 0 -(1)-> start_point -(2)-> num_base_points -(3)-> n_points. */
/* */
/* (1): exist from the beginning */
/* (2): components that have been loaded so far */
/* (3): the newly loaded component */
TT_Process_Composite_Component( loader, subglyph, start_point,
num_base_points );
}

//***restore stream
loader->stream = oldinc_stream;

/* process the glyph */
loader->ins_pos = ins_pos;
if ( IS_HINTED( loader->load_flags ) &&

#ifdef TT_USE_BYTECODE_INTERPRETER

subglyph->flags & WE_HAVE_INSTR &&

#endif

//***calling function below caused exception
num_points > start_point )
TT_Process_Composite_Glyph( loader, start_point, start_contour );

}

Martin Horak <horakm>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by horakm (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 09 Apr 2007 08:40:52 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.4
    Sat 10 Mar 2007 06:03:53 AM UTCwlAssigned toNone=>wl
    Fri 09 Mar 2007 09:36:50 PM UTCwlStatusNone=>Need Info

    Back to the top


    Powered by Savane 3.1-cleanup1