Thu 24 Jun 2010 09:17:09 PM UTC, original submission:
gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"
Font: http://alt.swiecki.net/j/f/sigabrt17.font
There's heap corruption somewhere in Mac font parsing functions. It might be related to: https://savannah.nongnu.org/bugs/?30248
I feel that these functions might need some serious amount of work to make them behave correctly.
$ valgrind ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x11020000002bb.INSTR.cmp_rax,_0xfffff000.ttf
==1703== Memcheck, a memory error detector
==1703== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==1703== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==1703== Command: ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x11020000002bb.INSTR.cmp_rax,_0xfffff000.ttf
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb141 is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb140 is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb13f is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2AA11: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb13e is not stack'd, malloc'd or (recently) free'd
==1703==
valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 18446744073709486080, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.
==1703== at 0x3802CA47: report_and_quit /tmp/vg/coregrind/m_libcassert.c:191
==1703== by 0x3802CC73: vgPlain_assert_fail /tmp/vg/coregrind/m_libcassert.c:265
==1703== by 0x3803800B: vgPlain_arena_malloc /tmp/vg/coregrind/m_mallocfree.c:246
==1703== by 0x38002DD4: vgMemCheck_new_block /tmp/vg/memcheck/mc_malloc_wrappers.c:199
==1703== by 0x380031D9: vgMemCheck_malloc /tmp/vg/memcheck/mc_malloc_wrappers.c:236
==1703== by 0x3806872E: vgPlain_scheduler /tmp/vg/coregrind/m_scheduler/scheduler.c:1384
==1703== by 0x3808EA10: run_a_thread_NORETURN /tmp/vg/coregrind/m_syswrap/syswrap-linux.c:94
sched status:
running_tid=1
Thread 1: status = VgTs_Runnable
==1703== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==1703== by 0x480BF7: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==1703== by 0x410FCE: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==1703== by 0x410F56: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==1703== by 0x407677: new_memory_stream /usr/local/google/src/freetype2/src/base/ftobjs.c:1271
==1703== by 0x407723: open_face_from_buffer /usr/local/google/src/freetype2/src/base/ftobjs.c:1301
==1703== by 0x407F47: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1588
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
|