The FreeType Project - Bugs: bug #30083, SIGSEGV while loading a glyph...
You are not allowed to post comments on this tracker with your current authentication level.
bug #30083: SIGSEGV while loading a glyph (index 49)
Submitter: | Robert Swiecki <jagger> | ||
Submitted: | Tue 08 Jun 2010 03:21:35 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.3.13 |
Fri 11 Jun 2010 06:14:36 AM UTC, comment #4: |
Werner LEMBERG <wl>![]() ![]() |
Thu 10 Jun 2010 05:49:15 PM UTC, comment #3: Yup, it was fixed in http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d3d2cc4fef72c6be9c454b3809c387e12b44cfc
It was buffer overflow in cff_decoder_parse_charstrings but now it's gone
(gdb) watch *0x7fffffffba10 == 0x00060000
Old value = 0
|
Robert Swiecki <jagger> |
Wed 09 Jun 2010 07:22:28 AM UTC, comment #2: I don't get this; however, I've already fixed #30082, maybe this makes the difference. Please check. Otherwise I would be glad if you could dig into this problem. |
Werner LEMBERG <wl>![]() ![]() |
Tue 08 Jun 2010 03:33:07 PM UTC, comment #1: Btw.. it crashes firefox as well..
$ LD_PRELOAD=/usr/local/src/freetype2/objs/.libs/libfreetype.so.6.4.0 LD_LIBRARY_PATH=/usr/lib/firefox-3.6.3/ /usr/lib/firefox-3.6.3/firefox-bin http://alt.swiecki.net/j/f.php?id=sigsegv5
Bogus values of rip and rbp looks, at the first glance, as a buffer overflow to me. |
Robert Swiecki <jagger> |
Tue 08 Jun 2010 03:21:35 PM UTC, original submission:
git sources as of 2010-06-08
Font: http://alt.swiecki.net/j/sigsegv5.ttf
The glyph index is 49
After setting breakpoint on FT_Load_Glyph and a few continue commands
Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=48, load_flags=512) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=49, load_flags=516) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
Program received signal SIGSEGV, Segmentation fault.
(gdb) info registers
(gdb) bt
The rbp and rip registers are smashed, so no useful stacktrace here. Let me know if you want me to provide more detailed analysis. |
Robert Swiecki <jagger> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Thanks for testing.