bugThe FreeType Project - Bugs: bug #22064, freetype 2.3.5 crashes when...

 
 

bug #22064: freetype 2.3.5 crashes when loading Alphabet_2.ttf

Submitted by:  Bill Clinton <ysangkok>
Submitted on:  Sun 20 Jan 2008 01:01:06 PM UTC  
Votes:  100  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.6

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 20 Jan 2008 05:30:53 PM UTC, comment #1:

Both problems appear to be fixed in the CVS already.

Thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 20 Jan 2008 01:01:06 PM UTC, original submission:

Hello.

janus@Gigabob:13:51:44$ gdb ftview
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(no debugging symbols found)
Using host libthread_db library "/lib/i686/cmov/libthread_db.so.1".
(gdb) run 72 /usr/local/share/fonts/downloaded/A/Alphabet_2.ttf
Starting program: /usr/bin/ftview 72 /usr/local/share/fonts/downloaded/A/Alphabet_2.ttf
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
0xb7f3bfa7 in TT_Load_Simple_Glyph (load=0xbfc2a5fc) at /tmp/freetype-2.3.5/src/truetype/ttgload.c:270
270 cont[0] = prev_cont = FT_NEXT_USHORT( p );
(gdb) bt
#0 0xb7f3bfa7 in TT_Load_Simple_Glyph (load=0xbfc2a5fc) at /tmp/freetype-2.3.5/src/truetype/ttgload.c:270
#1 0xb7f3c71f in load_truetype_glyph (loader=0xbfc2a5fc, glyph_index=1, recurse_count=0) at /tmp/freetype-2.3.5/src/truetype/ttgload.c:1286
#2 0xb7f3d75e in Load_Glyph (ttslot=0x8075e88, ttsize=0x8075fc8, glyph_index=1, load_flags=512) at /tmp/freetype-2.3.5/src/truetype/ttgload.c:1923
#3 0xb7f31297 in FT_Load_Glyph (face=0x8075288, glyph_index=1, load_flags=<value optimized out>) at /tmp/freetype-2.3.5/src/base/ftobjs.c:646
#4 0xb7f74aab in ftc_basic_family_load_glyph (ftcfamily=0x8076110, gindex=1, cache=0x80667c8, aglyph=0x8076834)
at /tmp/freetype-2.3.5/src/cache/ftcbasic.c:198
#5 0xb7f74a26 in ftc_inode_new (ftcpinode=0xbfc2a7e8, ftcgquery=0xbfc2a840, cache=0x80667c8) at /tmp/freetype-2.3.5/src/cache/ftcimage.c:79
#6 0xb7f75274 in FTC_Cache_NewNode (cache=0x80667c8, hash=37488988, query=0xbfc2a840, anode=0xbfc2a864) at /tmp/freetype-2.3.5/src/cache/ftccache.c:454
#7 0xb7f75b25 in FTC_ImageCache_LookupScaler (cache=0x80667c8, scaler=0x805e030, load_flags=512, gindex=1, aglyph=0xbfc2a8c8, anode=0x0)
at /tmp/freetype-2.3.5/src/cache/ftcbasic.c:418
#8 0x0804d27c in ?? ()
#9 0x080667c8 in ?? ()
#10 0x0805e030 in ?? ()
#11 0x00000200 in ?? ()
#12 0x00000001 in ?? ()
#13 0xbfc2a8c8 in ?? ()
#14 0x00000000 in ?? ()
(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0xb7f3bf87 to 0xb7f3bfc7:
0xb7f3bf87 <TT_Load_Simple_Glyph+103>: cmp %eax,0xffffffc4(%ebp)
0xb7f3bf8a <TT_Load_Simple_Glyph+106>: jb 0xb7f3c152 <TT_Load_Simple_Glyph+562>
0xb7f3bf90 <TT_Load_Simple_Glyph+112>: add 0xffffffe4(%ebp),%edx
0xb7f3bf93 <TT_Load_Simple_Glyph+115>: mov 0xffffffe4(%ebp),%ecx
0xb7f3bf96 <TT_Load_Simple_Glyph+118>: mov %edx,0xffffffe8(%ebp)
0xb7f3bf99 <TT_Load_Simple_Glyph+121>: movzbl 0xfffffffe(%edi),%eax
0xb7f3bf9d <TT_Load_Simple_Glyph+125>: movzbw 0xffffffff(%edi),%dx
0xb7f3bfa2 <TT_Load_Simple_Glyph+130>: shl $0x8,%eax
0xb7f3bfa5 <TT_Load_Simple_Glyph+133>: or %eax,%edx
0xb7f3bfa7 <TT_Load_Simple_Glyph+135>: mov %dx,(%ecx)
0xb7f3bfaa <TT_Load_Simple_Glyph+138>: add $0x2,%ecx
0xb7f3bfad <TT_Load_Simple_Glyph+141>: cmp %ecx,0xffffffe8(%ebp)
0xb7f3bfb0 <TT_Load_Simple_Glyph+144>: jbe 0xb7f3bffb <TT_Load_Simple_Glyph+219>
0xb7f3bfb2 <TT_Load_Simple_Glyph+146>: lea 0x4(%esi),%edi
0xb7f3bfb5 <TT_Load_Simple_Glyph+149>: movzbl 0xfffffffe(%edi),%eax
0xb7f3bfb9 <TT_Load_Simple_Glyph+153>: movzbw 0xffffffff(%edi),%si
0xb7f3bfbe <TT_Load_Simple_Glyph+158>: shl $0x8,%eax
0xb7f3bfc1 <TT_Load_Simple_Glyph+161>: or %eax,%esi
0xb7f3bfc3 <TT_Load_Simple_Glyph+163>: mov 0xffffffe4(%ebp),%eax
0xb7f3bfc6 <TT_Load_Simple_Glyph+166>: cmp %si,%dx
End of assembler dump.
(gdb) info all-registers
eax 0x0 0
ecx 0x0 0
edx 0x0 0
ebx 0xb7f91770 -1208412304
esp 0xbfc2a3b0 0xbfc2a3b0
ebp 0xbfc2a408 0xbfc2a408
esi 0xb7b2b882 -1213024126
edi 0xb7b2b884 -1213024124
eip 0xb7f3bfa7 0xb7f3bfa7 <TT_Load_Simple_Glyph+135>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
st0 0 (raw 0x00000000000000000000)
st1 0 (raw 0x00000000000000000000)
st2 0 (raw 0x00000000000000000000)
st3 0 (raw 0x00000000000000000000)
st4 0 (raw 0x00000000000000000000)
st5 1 (raw 0x3fff8000000000000000)
st6 0.99902248289345063625432885601185262 (raw 0x3ffeffbfeffbfeffc000)
st7 254.75073313782991224485385828302242 (raw 0x4006fec0300c0300c040)
fctrl 0x37f 895
fstat 0x4020 16416
ftag 0xffff 65535
fiseg 0x73 115
fioff 0x8050b52 134548306
foseg 0x7b 123
fooff 0xbfc2a5c2 -1077762622
fop 0x1c9 457
xmm0 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm1 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm2 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm3 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm4 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm5 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm6 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm7 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
mm0 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm1 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm2 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm3 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm4 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm5 {uint64 = 0x8000000000000000, v2_int32 = {0x0, 0x80000000}, v4_int16 = {0x0, 0x0, 0x0, 0x8000}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x80}}
---Type <return> to continue, or q <return> to quit---
mm6 {uint64 = 0xffbfeffbfeffc000, v2_int32 = {0xfeffc000, 0xffbfeffb}, v4_int16 = {0xc000, 0xfeff, 0xeffb, 0xffbf}, v8_int8 = {0x0, 0xc0, 0xff,
0xfe, 0xfb, 0xef, 0xbf, 0xff}}
mm7 {uint64 = 0xfec0300c0300c040, v2_int32 = {0x300c040, 0xfec0300c}, v4_int16 = {0xc040, 0x300, 0x300c, 0xfec0}, v8_int8 = {0x40, 0xc0, 0x0,
0x3, 0xc, 0x30, 0xc0, 0xfe}}
(gdb)

I have attached the font which makes FreeType crash.
I'm running Ubuntu on a Pentium 4. I compiled Freetype 2.3.5 from source.

Tell me if I have to compile SVN or anything.

Regards,
Janus Troelsen

Bill Clinton <ysangkok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14845:  BERLIN_REDRAIN.ttf added by ysangkok (29KiB - application/x-font-ttf - This font makes FreeType die with the same crash)
file #14843:  Alphabet_2.ttf added by ysangkok (22KiB - application/x-font-ttf - Font which makes FreeType crash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by ysangkok (Voted in favor of this item)
  • -unavailable- added by ysangkok (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 20 Jan 2008 05:30:53 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.6
    Sun 20 Jan 2008 02:16:34 PM UTCysangkokCarbon-Copy-=>Added ysangkok
    Sun 20 Jan 2008 01:08:00 PM UTCysangkokAttached File-=>Added BERLIN_REDRAIN.ttf, #14845
    Sun 20 Jan 2008 01:01:06 PM UTCysangkokAttached File-=>Added Alphabet_2.ttf, #14843

    Back to the top


    Powered by Savane 3.1-cleanup1