bugThe FreeType Project - Bugs: bug #30235, NULL-ptr deref. in...

 
 

bug #30235: NULL-ptr deref. in pfr/pfrgload.c:404

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Wed 23 Jun 2010 04:09:12 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 24 Jun 2010 06:21:38 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 23 Jun 2010 04:09:12 PM UTC, original submission:

gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), compiled with "-m32 -O0 -g"

Font: http://alt.swiecki.net/j/f/sigsegv13.pfr

$ gdb ./ftbench
(gdb) r -c 1 "SIGSEGV.PC.0x8079619.CODE.1.ADDR.
(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf"

Program received signal SIGSEGV, Segmentation fault.
0x08079619 in pfr_glyph_load_simple (glyph=0x80d3428, p=0xf7fd24d2 "", limit=0xf7fd2514 "U\377", <incomplete sequence \374>) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
404 pos[0].y = glyph->y_control[format_low];

(gdb) p glyph->y_control
$1 = (FT_Pos *) 0x0

(gdb) bt
#0 0x08079619 in pfr_glyph_load_simple (glyph=0x80d3428, p=0xf7fd24d2 "", limit=0xf7fd2514 "U\377", <incomplete sequence \374>) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
#1 0x08079ff9 in pfr_glyph_load_rec (glyph=0x80d3428, stream=0x80d2dd0, gps_offset=5290, offset=38, size=68) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
#2 0x0807a057 in pfr_glyph_load (glyph=0x80d3428, stream=0x80d2dd0, gps_offset=5290, offset=38, size=68) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
#3 0x0807a97f in pfr_slot_load (pfrslot=0x80d3388, pfrsize=0x80d3450, gindex=1, load_flags=2059) at /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
#4 0x0804c923 in FT_Load_Glyph (face=0x80d2e00, glyph_index=2, load_flags=2059) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#5 0x080994f6 in af_loader_load_g (loader=0x80d29dc, scaler=0xffffd4e4, glyph_index=2, load_flags=2049, depth=0) at /usr/local/google/src/freetype2/src/autofit/afloader.c:99
#6 0x0809a2b1 in af_loader_load_glyph (loader=0x80d29dc, face=0x80d2e00, gindex=2, load_flags=2049) at /usr/local/google/src/freetype2/src/autofit/afloader.c:531
#7 0x0809a320 in af_autofitter_load_glyph (module=0x80d29c8, slot=0x80d3388, size=0x80d3450, glyph_index=2, load_flags=0) at /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
#8 0x0804c8e9 in FT_Load_Glyph (face=0x80d2e00, glyph_index=2, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:668
#9 0x0804904c in test_load (timer=0xffffd628, face=0x80d2e00, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:218
#10 0x08048fab in benchmark (face=0x80d2e00, test=0xffffd678, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:188
#11 0x08049dd2 in main (argc=1, argv=0xffffd780) at /usr/local/google/src/freetype2-demos/src/ftbench.c:781

$ valgrind ./ftbench -c 1 "SIGSEGV.PC.0x8079619.CODE.1.ADDR.(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf"
VALGRIND_MEMORY_LIMIT_IN_MB=4095; VALGRIND_TIMEOUT=3600
==31424== Memcheck, a memory error detector
==31424== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==31424== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==31424== Command: ./ftbench -c 1 SIGSEGV.PC.0x8079619.CODE.1.ADDR.(nil).INSTR.mov_eax,_[eax].TIME.2010-06-23.01.54.04.PID.2050.ttf
==31424==
Load : ==31424== Invalid read of size 4
==31424== at 0x8079619: pfr_glyph_load_simple /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
==31424== by 0x8079FF8: pfr_glyph_load_rec /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
==31424== by 0x807A056: pfr_glyph_load /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
==31424== by 0x807A97E: pfr_slot_load /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
==31424== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==31424== by 0x80994F5: af_loader_load_g /usr/local/google/src/freetype2/src/autofit/afloader.c:99
==31424== by 0x809A2B0: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:531
==31424== by 0x809A31F: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==31424== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==31424== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==31424== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==31424== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==31424== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==31424==
==31424==
==31424== Process terminating with default action of signal 11 (SIGSEGV)
==31424== Access not within mapped region at address 0x0
==31424== at 0x8079619: pfr_glyph_load_simple /usr/local/google/src/freetype2/src/pfr/pfrgload.c:404
==31424== by 0x8079FF8: pfr_glyph_load_rec /usr/local/google/src/freetype2/src/pfr/pfrgload.c:808
==31424== by 0x807A056: pfr_glyph_load /usr/local/google/src/freetype2/src/pfr/pfrgload.c:834
==31424== by 0x807A97E: pfr_slot_load /usr/local/google/src/freetype2/src/pfr/pfrobjs.c:345
==31424== by 0x804C922: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==31424== by 0x80994F5: af_loader_load_g /usr/local/google/src/freetype2/src/autofit/afloader.c:99
==31424== by 0x809A2B0: af_loader_load_glyph /usr/local/google/src/freetype2/src/autofit/afloader.c:531
==31424== by 0x809A31F: af_autofitter_load_glyph /usr/local/google/src/freetype2/src/autofit/afmodule.c:65
==31424== by 0x804C8E8: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:668
==31424== by 0x804904B: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:218
==31424== by 0x8048FAA: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:188
==31424== by 0x8049DD1: main /usr/local/google/src/freetype2-demos/src/ftbench.c:781
==31424== If you believe this happened as a result of a stack
==31424== overflow in your program's main thread (unlikely but
==31424== possible), you can try to increase the size of the
==31424== main thread stack using the --main-stacksize= flag.
==31424== The main thread stack size used in this run was 8388608.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20797:  sigsegv13.pfr added by jagger (46KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 24 Jun 2010 06:21:38 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Wed 23 Jun 2010 04:09:12 PM UTCjaggerAttached File-=>Added sigsegv13.pfr, #20797

    Back to the top


    Powered by Savane 3.1-cleanup1