Sun 06 Jun 2010 09:42:59 AM UTC, comment #2:
I tested it with 32bit firefox (webfonts via libfreetype), and it hit the same bug (SIGFPE).
$ strace -f -e trace=signal ./firefox http://alt.swiecki.net/j/f.php?id=sigfpe&size=20
...
[pid 13032] --- SIGFPE (Floating point exception) @ 0 (0) ---
http://alt.swiecki.net/j/f.php?id=sigfpe&size=20
$ cat /proc/12896/maps | grep freetype
f59ab000-f5a1c000 r-xp 00000000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22
f5a1c000-f5a20000 r--p 00070000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22
f5a20000-f5a21000 rw-p 00074000 fc:01 266028 /usr/lib32/libfreetype.so.6.3.22
I'm afraid the bug is still there, unless there were changes to cff parsing between 6.3.22 and 6.4.0 ;).
Some more data from gdb:
Program received signal SIGFPE, Arithmetic exception.
0x00007ffff7b82757 in cff_parse_real (start=<value optimized out>, limit=<value optimized out>, power_ten=<value optimized out>, scaling=0x0) at /usr/local/src/freetype2/src/cff/cffparse.c:340
340 if ( ( number / power_tens[fraction_length] ) > 0x7FFFL )
(gdb) p fraction_length
$1 = 10
(gdb) p power_tens[fraction_length]
$2 = 0
(gdb) p number / power_tens[fraction_length]
Division by zero
My default gcc - gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), but compiling with
CC="gcc-3.4 -m32 -g"
LD="gcc-3.4 -m32"
I get the same bug
$ gdb ./ftview32 (btw, the libfreetype.a is statically compiled in)
(gdb) info files
Local exec file:
`/usr/local/fuzz/ttf/ftview32', file type elf32-i386.
(gdb) r -m "ABC" 30 OLD/SIGFPE.PC.0x7ffff7b834d7.CODE.1.ADDR.0x7ffff7b834d7.INSTR.dec_eax.TIME.2010-06-05.08.50.54.PID.11553.ttf
Program received signal SIGFPE, Arithmetic exception.
0x080743d8 in cff_parse_real (start=0xf7fd50dd "\036\341*", limit=0xf7fd50e7 "<\f\003\235\f\004\035", power_ten=0, scaling=0x0) at /usr/local/src/freetype2/src/cff/cffparse.c:340
340 if ( ( number / power_tens[fraction_length] ) > 0x7FFFL )
|