bugThe FreeType Project - Bugs: bug #30082, SIGSEGV while loading one of the...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30082: SIGSEGV while loading one of the glyphs (in freetype2/src/cff/cffgload.c)

Submitter:  Robert Swiecki <jagger>
Submitted:  Tue 08 Jun 2010 02:57:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.3.13

Wed 09 Jun 2010 07:15:29 AM UTC, comment #1: 

Fixed, thanks.

 Werner LEMBERG <wl>
Group administrator
Tue 08 Jun 2010 02:57:09 PM UTC, original submission:  

git sources as of 2010-06-08
Linux amd64, gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)

http://alt.swiecki.net/j/f/sigsegv4.ttf

It can be observed with ftbench

(gdb) r -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Starting program: /usr/local/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Load                      :
Program received signal SIGSEGV, Segmentation fault.
0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
314       glyph->root.outline = *builder->base;
(gdb) p glyph
$1 = (CFF_GlyphSlot) 0x60000
(gdb) x/x glyph
0x60000: Cannot access memory at address 0x60000
(gdb) bt
#0  0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
#1  0x00000000004363d4 in cff_slot_load (glyph=0x6d0150, size=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffgload.c:2764
#2  0x000000000042bee7 in Load_Glyph (cffslot=0x6d0150, cffsize=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffdrivr.c:182
#3  0x0000000000405a52 in FT_Load_Glyph (face=0x6ada60, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/base/ftobjs.c:677
#4  0x00000000004017c4 in test_load (timer=0x7fffffffe230, face=0x6ada60, user_data=0x0) at /usr/local/src/freetype2-demos/src/ftbench.c:218
#5  0x00000000004016fe in benchmark (face=0x6ada60, test=0x7fffffffe2a0, max_iter=1, max_time=2) at /usr/local/src/freetype2-demos/src/ftbench.c:188
#6  0x000000000040275f in main (argc=1, argv=0x7fffffffe410) at /usr/local/src/freetype2-demos/src/ftbench.c:781


The glyph_index is 1718, so the rest of the viewers (ftview, ftstring) will not crash by default, as they don't use such big indexes (maybe I just need to force them to display more characters).

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-09 wl Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.13
    2010-06-09 wl StatusNone Fixed

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-ab57.
    Corresponding source code