Wed 23 Jun 2010 04:09:12 PM UTC, original submission:
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), compiled with "-m32 -O0 -g"
Font: http://alt.swiecki.net/j/f/sigsegv13.pfr
$ gdb ./ftbench
(gdb) r -c 1 "SIGSEGV.PC.0x8079619.CODE.1.ADDR.
(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf"
Program received signal SIGSEGV, Segmentation fault.
0x08079619 in pfr_glyph_load_simple (glyph=0x80d3428, p=0xf7fd24d2 "", limit=0xf7fd2514 "U\377", <incomplete sequence \374>) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
404 pos[0].y = glyph->y_control[format_low];
(gdb) p glyph->y_control
$1 = (FT_Pos *) 0x0
(gdb) bt
#0 0x08079619 in pfr_glyph_load_simple (glyph=0x80d3428, p=0xf7fd24d2 "", limit=0xf7fd2514 "U\377", <incomplete sequence \374>) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
#1 0x08079ff9 in pfr_glyph_load_rec (glyph=0x80d3428, stream=0x80d2dd0, gps_offset=5290, offset=38, size=68) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
#2 0x0807a057 in pfr_glyph_load (glyph=0x80d3428, stream=0x80d2dd0, gps_offset=5290, offset=38, size=68) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
#3 0x0807a97f in pfr_slot_load (pfrslot=0x80d3388, pfrsize=0x80d3450, gindex=1, load_flags=2059) at /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
#4 0x0804c923 in FT_Load_Glyph (face=0x80d2e00, glyph_index=2, load_flags=2059) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#5 0x080994f6 in af_loader_load_g (loader=0x80d29dc, scaler=0xffffd4e4, glyph_index=2, load_flags=2049, depth=0) at /usr/local/google/src/freetype2/src/autofit/afloader.c:99
#6 0x0809a2b1 in af_loader_load_glyph (loader=0x80d29dc, face=0x80d2e00, gindex=2, load_flags=2049) at /usr/local/google/src/freetype2/src/autofit/afloader.c:531
#7 0x0809a320 in af_autofitter_load_glyph (module=0x80d29c8, slot=0x80d3388, size=0x80d3450, glyph_index=2, load_flags=0) at /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
#8 0x0804c8e9 in FT_Load_Glyph (face=0x80d2e00, glyph_index=2, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:668
#9 0x0804904c in test_load (timer=0xffffd628, face=0x80d2e00, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:218
#10 0x08048fab in benchmark (face=0x80d2e00, test=0xffffd678, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:188
#11 0x08049dd2 in main (argc=1, argv=0xffffd780) at /usr/local/google/src/freetype2-demos/src/ftbench.c:781
$ valgrind ./ftbench -c 1 "SIGSEGV.PC.0x8079619.CODE.1.ADDR.(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf"
VALGRIND_MEMORY_LIMIT_IN_MB=4095; VALGRIND_TIMEOUT=3600
==31424== Memcheck, a memory error detector
==31424== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==31424== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==31424== Command: ./ftbench -c 1 SIGSEGV.PC.0x8079619.CODE.1.ADDR.(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf
==31424==
Load : ==31424== Invalid read of size 4
==31424== at 0x8079619: pfr_glyph_load_simple /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
==31424== by 0x8079FF8: pfr_glyph_load_rec /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
==31424== by 0x807A056: pfr_glyph_load /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
==31424== by 0x807A97E: pfr_slot_load /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
==31424== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==31424== by 0x80994F5: af_loader_load_g /usr/local/google/src/freetype2/src/autofit/afloader.c:99
==31424== by 0x809A2B0: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:531
==31424== by 0x809A31F: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==31424== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==31424== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==31424== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==31424== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==31424== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==31424==
==31424==
==31424== Process terminating with default action of signal 11 (SIGSEGV)
==31424== Access not within mapped region at address 0x0
==31424== at 0x8079619: pfr_glyph_load_simple /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
==31424== by 0x8079FF8: pfr_glyph_load_rec /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
==31424== by 0x807A056: pfr_glyph_load /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
==31424== by 0x807A97E: pfr_slot_load /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
==31424== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==31424== by 0x80994F5: af_loader_load_g /usr/local/google/src/freetype2/src/autofit/afloader.c:99
==31424== by 0x809A2B0: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:531
==31424== by 0x809A31F: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==31424== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==31424== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==31424== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==31424== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==31424== If you believe this happened as a result of a stack
==31424== overflow in your program's main thread (unlikely but
==31424== possible), you can try to increase the size of the
==31424== main thread stack using the --main-stacksize= flag.
==31424== The main thread stack size used in this run was 8388608.
|