bugThe FreeType Project - Bugs: bug #30053, FLoating point exception (divide...

 
 

bug #30053: FLoating point exception (divide by zero) in freetype2/src/cff/cffparse.c

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Sat 05 Jun 2010 03:01:22 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 08 Jun 2010 02:15:59 PM UTC, comment #4:

Yup, looks good. Thanks for the fix.

Robert Swiecki <jagger>
Tue 08 Jun 2010 11:30:28 AM UTC, comment #3:

Thanks. I've found the problem. It should be fixed now. Please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 06 Jun 2010 09:42:59 AM UTC, comment #2:

I tested it with 32bit firefox (webfonts via libfreetype), and it hit the same bug (SIGFPE).

$ strace -f -e trace=signal ./firefox http://alt.swiecki.net/j/f.php?id=sigfpe&size=20
...
[pid 13032] --- SIGFPE (Floating point exception) @ 0 (0) ---

http://alt.swiecki.net/j/f.php?id=sigfpe&size=20

$ cat /proc/12896/maps | grep freetype
f59ab000-f5a1c000 r-xp 00000000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22
f5a1c000-f5a20000 r--p 00070000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22
f5a20000-f5a21000 rw-p 00074000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22

I'm afraid the bug is still there, unless there were changes to cff parsing between 6.3.22 and 6.4.0 ;).

Some more data from gdb:

Program received signal SIGFPE, Arithmetic exception.
0x00007ffff7b82757 in cff_parse_real (start=<value optimized out>, limit=<value optimized out>, power_ten=<value optimized out>, scaling=0x0) at /usr/local/src/freetype2/src/cff/cffparse.c:340

340 if ( ( number / power_tens[fraction_length] ) > 0x7FFFL )
(gdb) p fraction_length
$1 = 10
(gdb) p power_tens[fraction_length]
$2 = 0
(gdb) p number / power_tens[fraction_length]
Division by zero

My default gcc - gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), but compiling with

CC="gcc-3.4 -m32 -g"
LD="gcc-3.4 -m32"

I get the same bug

$ gdb ./ftview32 (btw, the libfreetype.a is statically compiled in)

(gdb) info files
Local exec file:
`/usr/local/fuzz/ttf/ftview32', file type elf32-i386.

(gdb) r -m "ABC" 30 OLD/SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf

Program received signal SIGFPE, Arithmetic exception.
0x080743d8 in cff_parse_real (start=0xf7fd50dd "\036\341*", limit=0xf7fd50e7 "<\f\003\235\f\004\035", power_ten=0, scaling=0x0) at /usr/local/src/freetype2/src/cff/cffparse.c:340
340 if ( ( number / power_tens[fraction_length] ) > 0x7FFFL )

Robert Swiecki <jagger>
Sat 05 Jun 2010 04:41:35 PM UTC, comment #1:

On my Intel 32bit GNU/Linux box using gcc 4.5.0, it works. Neither valgrind nor gdb shows a problem. Can you try a different compiler or compiler version?

Note that I'm usually compiling and testing with `make devel; make' which disables optimization.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 05 Jun 2010 03:01:22 PM UTC, original submission:

System: Linux amd64, freetype2 from git (as of 2010-06-05)

$ LD_PRELOAD=./libfreetype.so.6.4.0 ./ftview -m "ABC" 25 OLD/SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf Floating point exception

in gdb

(gdb) r -m "ABC" 25 OLD/SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf
Starting program: /usr/local/fuzz/ttf/ftview -m "ABC" 25 OLD/SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf

Program received signal SIGFPE, Arithmetic exception.
0x00007ffff7b82757 in cff_parse_real (start=<value optimized out>, limit=<value optimized out>, power_ten=<value optimized out>, scaling=0x0) at /usr/local/src/freetype2/src/cff/cffparse.c:340
340 if ( ( number / power_tens[fraction_length] ) > 0x7FFFL )
(gdb) p power_tens[fraction_length]
$1 = 0

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 08 Jun 2010 11:30:28 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Sat 05 Jun 2010 04:41:35 PM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Sat 05 Jun 2010 03:01:22 PM UTCjaggerAttached File-=>Added SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf, #20691

    Back to the top


    Powered by Savane 3.1-cleanup1