bugThe FreeType Project - Bugs: bug #30108, SIGSEGV (NULL ptr deref) in...

 
 

bug #30108: SIGSEGV (NULL ptr deref) in freetype2/src/autofit/afglobal.c:272

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 10 Jun 2010 07:33:20 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 15 Jun 2010 06:30:47 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 10 Jun 2010 07:33:20 PM UTC, original submission:

git sources as of 2010-06-10, gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), compiled with -m32 -O0

Font: http://alt.swiecki.net/j/f/sigsegv6.ttf (glyph_id == 20)

$ gdb ./ftbench
(gdb) r -c 1 sigsegv6.ttf
Load : 68.045 us/op
Load_Advances (Normal) : 2.360 us/op
Load_Advances (Fast) :
Program received signal SIGSEGV, Segmentation fault.
0x08093485 in af_face_globals_get_metrics (globals=0x80f4460, gindex=20, options=0, ametrics=0xffffd4e4) at /usr/local/google/src/freetype2/src/autofit/afglobal.c:272
272 script = clazz->script;
(gdb) p clazz
$1 = (AF_ScriptClass) 0x33ff
(gdb) x/x clazz
0x33ff: Cannot access memory at address 0x33ff
(gdb) bt
#0 0x08093485 in af_face_globals_get_metrics (globals=0x80f4460, gindex=20, options=0, ametrics=0xffffd4e4) at /usr/local/google/src/freetype2/src/autofit/afglobal.c:272
#1 0x0809a16f in af_loader_load_glyph (loader=0x80d29fc, face=0x80d2e70, gindex=20, load_flags=65792) at /usr/local/google/src/freetype2/src/autofit/afloader.c:509
#2 0x0809a2ab in af_autofitter_load_glyph (module=0x80d29e8, slot=0x80d4960, size=0x80d4ab0, glyph_index=20, load_flags=65792) at /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
#3 0x0804c8e9 in FT_Load_Glyph (face=0x80d2e70, glyph_index=20, load_flags=65792) at /usr/local/google/src/freetype2/src/base/ftobjs.c:668
#4 0x0804a7f9 in FT_Get_Advances (face=0x80d2e70, start=0, count=731, flags=65792, padvances=0x80f6140) at /usr/local/google/src/freetype2/src/base/ftadvanc.c:146
#5 0x080490e9 in test_load_advances (timer=0xffffd668, face=0x80d2e70, user_data=0xffffd6dc) at /usr/local/google/src/freetype2-demos/src/ftbench.c:242
#6 0x08048fab in benchmark (face=0x80d2e70, test=0xffffd6b8, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:188
#7 0x08049ed2 in main (argc=1, argv=0xffffd7c0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:807

$ valgrind ./ftbench -c 1 sigsegv6.ttf
Load : 1184.681 us/op
Load_Advances (Normal) : 52.679 us/op
Load_Advances (Fast) : ==5949== Invalid read of size 4
==5949== at 0x8093485: af_face_globals_get_metrics /usr/local/google/src/freetype2/src/autofit/afglobal.c:272
==5949== by 0x809A16E: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:509
==5949== by 0x809A2AA: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==5949== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==5949== by 0x804A7F8: FT_Get_Advances /usr/local/google/src/freetype2/src/base/ftadvanc.c:146
==5949== by 0x80490E8: test_load_advances /usr/local/google/src/freetype2-demos/src/ftbench.c:242
==5949== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==5949== by 0x8049ED1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:807
==5949== Address 0x33ff is not stack'd, malloc'd or (recently) free'd
==5949==
==5949==
==5949== Process terminating with default action of signal 11 (SIGSEGV)
==5949== Access not within mapped region at address 0x33FF
==5949== at 0x8093485: af_face_globals_get_metrics /usr/local/google/src/freetype2/src/autofit/afglobal.c:272
==5949== by 0x809A16E: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:509
==5949== by 0x809A2AA: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==5949== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==5949== by 0x804A7F8: FT_Get_Advances /usr/local/google/src/freetype2/src/base/ftadvanc.c:146
==5949== by 0x80490E8: test_load_advances /usr/local/google/src/freetype2-demos/src/ftbench.c:242
==5949== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==5949== by 0x8049ED1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:807
==5949== If you believe this happened as a result of a stack
==5949== overflow in your program's main thread (unlikely but
==5949== possible), you can try to increase the size of the
==5949== main thread stack using the --main-stacksize= flag.
==5949== The main thread stack size used in this run was 8388608.

Again, feel free to ping me for more data if needed.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 15 Jun 2010 06:30:47 AM UTCwlAssigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Tue 15 Jun 2010 06:30:46 AM UTCwlStatusNone=>Fixed

    Back to the top


    Powered by Savane 3.1-cleanup1