Tue 15 Jun 2010 07:29:00 PM UTC, original submission:
git sources as of Jun 2010-06-15
Font: http://alt.swiecki.net/j/f/sigsegv8.pfa
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) - library and tools compiled with -m32 -O0 -g
$ gdb ./ftbench
(gdb) r -c 1 sigsegv8.pfa
Program received signal SIGSEGV, Segmentation fault.
0x080afabe in t1_builder_add_contour (builder=0xffffcee4) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
1594 outline->n_contours++;
(gdb) p outline
$1 = (FT_Outline *) 0x0
(gdb) bt
#0 0x080afabe in t1_builder_add_contour (builder=0xffffcee4) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
#1 0x080afba3 in t1_builder_start_point (builder=0xffffcee4, x=0, y=0) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
#2 0x080b1046 in t1_decoder_parse_charstrings (decoder=0xffffcee4,
charstring_base=0x80dba7c "frL\312$xJޯc\370\021\234\066\b\005\276\065p\240)\345c\005\061\tV\231k\245\374\376\251\375I\032\001\225q\020\307\062\350E\215\327c\\)\310\325\070\256\212r", charstring_len=97)
at /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
#3 0x0806a88e in T1_Parse_Glyph_And_Get_Char_String (decoder=0xffffcee4, glyph_index=21, char_string=0xffffce90) at /usr/local/google/src/freetype2/src/type1/t1gload.c:93
#4 0x0806a972 in T1_Parse_Glyph (decoder=0xffffcee4, glyph_index=21) at /usr/local/google/src/freetype2/src/type1/t1gload.c:129
#5 0x0806aad8 in T1_Compute_Max_Advance (face=0x80d2e00, max_advance=0xffffd510) at /usr/local/google/src/freetype2/src/type1/t1gload.c:197
#6 0x0806a447 in T1_Face_Init (stream=0x80d2dd0, face=0x80d2e00, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/type1/t1objs.c:468
#7 0x0804d0c6 in open_face (driver=0x80d2620, stream=0x80d2dd0, face_index=0, num_params=0, params=0x0, aface=0xffffd5f8) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
#8 0x0804e331 in FT_Open_Face (library=0x80ce020, args=0xffffd630, face_index=0, aface=0xffffd70c) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
#9 0x0804d1bb in FT_New_Face (library=0x80ce020, pathname=0xffffd994 "sigsegv8.pfa", face_index=0, aface=0xffffd70c) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#10 0x08049995 in get_face (face=0xffffd70c) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#11 0x08049c5b in main (argc=1, argv=0xffffd7d0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Command: ./ftbench -c 1 sigsegv8.pfa
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FC8F: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:585
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d87318 is 0 bytes after a block of size 72 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FAAF: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:444
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d87678 is 112 bytes inside a block of size 113 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D30159: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:952
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88250 is 8 bytes before a block of size 170 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FE3F: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:715
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88388 is 80 bytes inside a block of size 82 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FADF: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:456
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88410 is 80 bytes inside a block of size 82 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 2
==27444== at 0x80AFABE: t1_builder_add_contour /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
==27444== by 0x80AFBA2: t1_builder_start_point /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
==27444== by 0x80B1045: t1_decoder_parse_charstrings /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
==27444== by 0x806A88D: T1_Parse_Glyph_And_Get_Char_String /usr/local/google/src/freetype2/src/type1/t1gload.c:93
==27444== by 0x806A971: T1_Parse_Glyph /usr/local/google/src/freetype2/src/type1/t1gload.c:129
==27444== by 0x806AAD7: T1_Compute_Max_Advance /usr/local/google/src/freetype2/src/type1/t1gload.c:197
==27444== by 0x806A446: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:468
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27444==
==27444==
==27444== Process terminating with default action of signal 11 (SIGSEGV)
==27444== Access not within mapped region at address 0x0
==27444== at 0x80AFABE: t1_builder_add_contour /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
==27444== by 0x80AFBA2: t1_builder_start_point /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
==27444== by 0x80B1045: t1_decoder_parse_charstrings /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
==27444== by 0x806A88D: T1_Parse_Glyph_And_Get_Char_String /usr/local/google/src/freetype2/src/type1/t1gload.c:93
==27444== by 0x806A971: T1_Parse_Glyph /usr/local/google/src/freetype2/src/type1/t1gload.c:129
==27444== by 0x806AAD7: T1_Compute_Max_Advance /usr/local/google/src/freetype2/src/type1/t1gload.c:197
==27444== by 0x806A446: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:468
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== If you believe this happened as a result of a stack
==27444== overflow in your program's main thread (unlikely but
==27444== possible), you can try to increase the size of the
==27444== main thread stack using the --main-stacksize= flag.
==27444== The main thread stack size used in this run was 8388608.
==27444==
==27444== HEAP SUMMARY:
==27444== in use at exit: 27,281 bytes in 57 blocks
==27444== total heap usage: 140 allocs, 83 frees, 63,918 bytes allocated
==27444==
==27444== LEAK SUMMARY:
==27444== definitely lost: 0 bytes in 0 blocks
==27444== indirectly lost: 0 bytes in 0 blocks
==27444== possibly lost: 0 bytes in 0 blocks
==27444== still reachable: 27,281 bytes in 57 blocks
==27444== suppressed: 0 bytes in 0 blocks
|