Thu 17 Jun 2010 12:44:05 PM UTC, original submission:
git sources as of Jun 15, 2010
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), the lib and the tools compiled with "-m32 -O0 -g"
two test-cases, but crashing on different instructions under x86 - "call edx", and "mov_[esp+0x8], edx" - what clearly shows it's a stack underflow
http://alt.swiecki.net/j/f/sigsegv10.pfr
http://alt.swiecki.net/j/f/sigsegv11.pfr
$ gdb ./ftbench
(gdb) r -c 1 sigsegv10.pfr
Program received signal SIGSEGV, Segmentation fault.
0x080b397a in ft_realloc (memory=0x80ce008, cur_size=4492320, new_size=4492416, block=0xf7724008) at builds/unix/ftsystem.c:135
135 return realloc( block, new_size );
(gdb) bt
#0 0x080b397a in ft_realloc (memory=0x80ce008, cur_size=4492320, new_size=4492416, block=0xf7724008) at builds/unix/ftsystem.c:135
#1 0x08055042 in ft_mem_qrealloc (memory=0x80ce008, item_size=24, cur_count=187180, new_count=187184, block=0xf7724008, p_error=0xff5fe07c) at /usr/local/google/src/freetype2/src/base/ftutil.c:154
#2 0x08054f24 in ft_mem_realloc (memory=0x80ce008, item_size=24, cur_count=187180, new_count=187184, block=0xf7724008, p_error=0xff5fe0dc) at /usr/local/google/src/freetype2/src/base/ftutil.c:101
#3 0x08079a18 in pfr_glyph_load_compound (glyph=0x80d3100, p=0xf7fd474d "\017\033\"\242\017\063\"o\202\017\234\032\314\006\252\376Z\" {\004 \002\301\003\061Q", limit=0xf7fd4767 "Q")
at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:601
#4 0x08079e19 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:737
#5 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#6 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#7 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#8 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#9 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#10 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
|