bugThe FreeType Project - Bugs: bug #30254, SIGSEGV caused by...

 
 

bug #30254: SIGSEGV caused by psnames/psmodule.c:261

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 24 Jun 2010 09:52:15 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 25 Jun 2010 07:55:43 PM UTC, comment #4:

Fixed in git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 25 Jun 2010 12:13:13 PM UTC, comment #3:

Thank you Werner,

I've tested on GNU/Linux on i386 (32bit),
Mac OS X 10.6 on x86_64 (64bit), and
GNU/Linux on amd64 (64bit).
Although valgrind reports some access to
unallocated memory, the platform I found
SEGV was only GNU/Linux on amd64.

suzuki toshiya <mpsuzuki>
Project Administrator
Fri 25 Jun 2010 07:24:38 AM UTC, comment #2:

I'll take it, if you don't mind :)

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 25 Jun 2010 12:42:58 AM UTC, comment #1:

I will take a look, please wait.

suzuki toshiya <mpsuzuki>
Project Administrator
Thu 24 Jun 2010 09:52:15 PM UTC, original submission:

gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"

Font: http://alt.swiecki.net/j/f/sigsegv18.otp

Arguments to strcmp() are invalid.

$ gdb ./ftbench
(gdb) r -c 1 sigsegv18.otp

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:100
100 ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
in ../sysdeps/x86_64/multiarch/../strcmp.S

(gdb) bt
#0 __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:100
#1 0x00000000004805ba in ps_check_extra_glyph_name (gname=0x6cecb0 <Address 0x6cecb0 out of bounds>, glyph=358, extra_glyphs=0x7fffffffdf10, states=0x7fffffffdf40) at /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
#2 0x0000000000480775 in ps_unicodes_init (memory=0x6a9010, table=0x6b14d0, num_glyphs=676, get_glyph_name=0x437f1b <cff_sid_to_glyph_name>, free_glyph_name=0, glyph_data=0x6b9850)
at /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
#3 0x000000000043800f in cff_cmap_unicode_init (unicodes=0x6b14d0) at /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
#4 0x000000000040a66f in FT_CMap_New (clazz=0x6a4520, init_data=0x0, charmap=0x7fffffffe0a0, acmap=0x0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
#5 0x000000000043305e in cff_face_init (stream=0x6b1470, cffface=0x6b9850, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
#6 0x0000000000407427 in open_face (driver=0x6adca0, stream=0x6b1470, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe2c8) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
#7 0x00000000004089c7 in FT_Open_Face (library=0x6a9040, args=0x7fffffffe340, face_index=0, aface=0x7fffffffe408) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
#8 0x0000000000407544 in FT_New_Face (library=0x6a9040, pathname=0x7fffffffe983 "sigsegv18.otp", face_index=0, aface=0x7fffffffe408) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#9 0x0000000000403240 in get_face (face=0x7fffffffe408) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#10 0x0000000000402ee9 in test_new_face (timer=0x7fffffffe460, face=0x6aea60, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:515
#11 0x00000000004025a8 in benchmark (face=0x6aea60, test=0x7fffffffe4d0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:188
#12 0x00000000004039f3 in main (argc=1, argv=0x7fffffffe650) at /usr/local/google/src/freetype2-demos/src/ftbench.c:861

$ valgrind ./ftbench -c 1 sigsegv18.otp
==30617== Memcheck, a memory error detector
==30617== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==30617== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==30617== Command: ./ftbench -c 1 sigsegv18.otp
==30617==
==30617== Invalid read of size 8
==30617== at 0x51725DA: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/x86_64/multiarch/../strcmp.S:100
==30617== by 0x4805B9: ps_check_extra_glyph_name /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
==30617== by 0x480774: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 8
==30617== at 0x51725E3: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/x86_64/multiarch/../strcmp.S:102
==30617== by 0x4805B9: ps_check_extra_glyph_name /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
==30617== by 0x480774: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2708 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 1
==30617== at 0x51737F4: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/x86_64/multiarch/../strcmp.S:2069
==30617== by 0x4805B9: ps_check_extra_glyph_name /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
==30617== by 0x480774: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 8
==30617== at 0x5173234: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/x86_64/multiarch/../strcmp.S:1440
==30617== by 0x4805B9: ps_check_extra_glyph_name /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
==30617== by 0x480774: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 8
==30617== at 0x5172B74: __strcmp_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/x86_64/multiarch/../strcmp.S:708
==30617== by 0x4805B9: ps_check_extra_glyph_name /usr/local/google/src/freetype2/src/psnames/psmodule.c:261
==30617== by 0x480774: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:333
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 1
==30617== at 0x4802BD: ps_unicode_value /usr/local/google/src/freetype2/src/psnames/psmodule.c:50
==30617== by 0x480780: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:335
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 1
==30617== at 0x4803A0: ps_unicode_value /usr/local/google/src/freetype2/src/psnames/psmodule.c:102
==30617== by 0x480780: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:335
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==
==30617== Invalid read of size 1
==30617== at 0x480490: ps_unicode_value /usr/local/google/src/freetype2/src/psnames/psmodule.c:147
==30617== by 0x480780: ps_unicodes_init /usr/local/google/src/freetype2/src/psnames/psmodule.c:335
==30617== by 0x43800E: cff_cmap_unicode_init /usr/local/google/src/freetype2/src/cff/cffcmap.c:149
==30617== by 0x40A66E: FT_CMap_New /usr/local/google/src/freetype2/src/base/ftobjs.c:3052
==30617== by 0x43305D: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:890
==30617== by 0x407426: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==30617== by 0x4089C6: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==30617== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==30617== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==30617== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==30617== Address 0x53e2700 is not stack'd, malloc'd or (recently) free'd
==30617==

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20814:  sigsegv18.otp added by jagger (166KiB - application/vnd.oasis.opendocument.presentation-template)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by mpsuzuki (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 25 Jun 2010 07:55:43 PM UTCwlStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Fri 25 Jun 2010 07:24:38 AM UTCwlAssigned tompsuzuki=>wl
    Fri 25 Jun 2010 12:42:58 AM UTCmpsuzukiAssigned toNone=>mpsuzuki
    Thu 24 Jun 2010 09:52:15 PM UTCjaggerAttached File-=>Added sigsegv18.otp, #20814

    Back to the top


    Powered by Savane 3.1-cleanup1