Tue 08 Jun 2010 02:57:09 PM UTC, original submission:
git sources as of 2010-06-08
Linux amd64, gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)
http://alt.swiecki.net/j/f/sigsegv4.ttf
It can be observed with ftbench
(gdb) r -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Starting program: /usr/local/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x4320bb.CODE.1.ADDR.0x260000.INSTR.dec_eax.TIME.2010-06-08.16.17.43.PID.29305.ttf
Load :
Program received signal SIGSEGV, Segmentation fault.
0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
314 glyph->root.outline = *builder->base;
(gdb) p glyph
$1 = (CFF_GlyphSlot) 0x60000
(gdb) x/x glyph
0x60000: Cannot access memory at address 0x60000
(gdb) bt
#0 0x00000000004320bb in cff_builder_done (builder=0x7fffffffd880) at /usr/local/src/freetype2/src/cff/cffgload.c:314
#1 0x00000000004363d4 in cff_slot_load (glyph=0x6d0150, size=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffgload.c:2764
#2 0x000000000042bee7 in Load_Glyph (cffslot=0x6d0150, cffsize=0x6d0360, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/cff/cffdrivr.c:182
#3 0x0000000000405a52 in FT_Load_Glyph (face=0x6ada60, glyph_index=1718, load_flags=0) at /usr/local/src/freetype2/src/base/ftobjs.c:677
#4 0x00000000004017c4 in test_load (timer=0x7fffffffe230, face=0x6ada60, user_data=0x0) at /usr/local/src/freetype2-demos/src/ftbench.c:218
#5 0x00000000004016fe in benchmark (face=0x6ada60, test=0x7fffffffe2a0, max_iter=1, max_time=2) at /usr/local/src/freetype2-demos/src/ftbench.c:188
#6 0x000000000040275f in main (argc=1, argv=0x7fffffffe410) at /usr/local/src/freetype2-demos/src/ftbench.c:781
The glyph_index is 1718, so the rest of the viewers (ftview, ftstring) will not crash by default, as they don't use such big indexes (maybe I just need to force them to display more characters).
|