Fri 02 Jul 2010 08:50:22 AM UTC, comment #4:
According to Adobe Technical Note 5040, font driver should not
load the segment whose flag is set to 0x00, because it is the
segment for comment (thus, the producer of sigsegv27.ttf may
think the length is not needed to be exact...?).
Anyway, SEGV issue is fixed, but FT2 could not parse a usable
face from loaded PFB image. I tried to make Mac OS X validate
the fonts (sigsegv26.ttf and sigsegv27.ttf), but I could not.
At least, PFB image included in sigsegv26.ttf seems to be broken.
In it, a list of font names is broken, a few bytes are replaced by
binary bytes. Like...
dup 123 /bullet put
dup 124 /H9284 put
dup 12\036 /H11008 put
dup 126 /H20849 put
Oh, 12\036 might be broken 125.
jagger, if you know any platform that recognize sample font files
correctly, please let me know.
(file #20878)
|
Thu 01 Jul 2010 09:22:34 AM UTC, comment #1:
The SEGV is caused by an overlooked case about
odd-sized fragment of POST resource. sigsegv26.ttf
includes 13 fragments of PFA, the last fragment
is zero-sized. Current FT2 expects any fragment
is longer than 16-bit, and calculate the size aslike:
1543 error = FT_Stream_Seek( stream, offsets[i] );
1544 if ( error )
1545 goto Exit2;
1546 if ( FT_READ_LONG( rlen ) )
1547 goto Exit;
1548 if ( FT_READ_USHORT( flags ) )
1549 goto Exit;
1550 rlen -= 2; /* the flags are part of the resource */
In sigsegv26.ttf, the final fragment sets rlen to 0, and
"rlen -= 2" causes underflow for unsigned long value.
It makes FT_Stream_Read() failed, because rlen is almost
about ULONG_MAX.
For first, I will insert "rlen" check to prevent this underflow
(soon), then try to fix to load the font correctly.
|
Wed 30 Jun 2010 03:49:03 PM UTC, original submission:
gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"
Fonts: http://alt.swiecki.net/j/f/sigsegv26.ttf http://alt.swiecki.net/j/f/sigsegv27.ttf
$ gdb ./ftbench
(gdb) r -c 1 sigsegv26.ttf
Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:433
433 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S
(gdb) up
#1 0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
145 FT_MEM_COPY( buffer, stream->base + pos, read_bytes );
(gdb) p buffer
$4 = (FT_Byte *) 0x6b2f2b "\377\377\377"
(gdb) p buffer + read_bytes - 1
$5 = (FT_Byte *) 0x6e3ec1 <Address 0x6e3ec1 out of bounds>
(gdb) bt
#0 memcpy () at ../sysdeps/x86_64/memcpy.S:433
#1 0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2 0x000000000040ec45 in FT_Stream_Read (stream=0x6ada00, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3 0x000000000040776a in Mac_Read_POST_Resource (library=0x6a8040, stream=0x6ada00, offsets=0x6adb40, resource_cnt=13, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
#4 0x0000000000407b13 in IsMacResource (library=0x6a8040, stream=0x6ada00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
#5 0x0000000000407d86 in IsMacBinary (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
#6 0x0000000000407fbe in load_mac_face (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
#7 0x00000000004083d4 in FT_Open_Face (library=0x6a8040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
#8 0x0000000000406e2c in FT_New_Face (library=0x6a8040, pathname=0x7fffffffe993 "sigsegv26.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#9 0x0000000000402b30 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#10 0x0000000000402e9f in main (argc=1, argv=0x7fffffffe670) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Memcheck, a memory error detector
==32065== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32065== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==32065== Command: ./ftbench -c 1 sigsegv26.ttf
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be81 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be80 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be7f is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2AA11: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be7e is not stack'd, malloc'd or (recently) free'd
==32065==
valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 18446744073709486080, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.
==32065== at 0x3802CA47: report_and_quit /tmp/vg/coregrind/m_libcassert.c:191
==32065== by 0x3802CC73: vgPlain_assert_fail /tmp/vg/coregrind/m_libcassert.c:265
==32065== by 0x3803800B: vgPlain_arena_malloc /tmp/vg/coregrind/m_mallocfree.c:246
==32065== by 0x38002DD4: vgMemCheck_new_block /tmp/vg/memcheck/mc_malloc_wrappers.c:199
==32065== by 0x380031D9: vgMemCheck_malloc /tmp/vg/memcheck/mc_malloc_wrappers.c:236
==32065== by 0x3806872E: vgPlain_scheduler /tmp/vg/coregrind/m_scheduler/scheduler.c:1384
==32065== by 0x3808EA10: run_a_thread_NORETURN /tmp/vg/coregrind/m_syswrap/syswrap-linux.c:94
sched status:
running_tid=1
Thread 1: status = VgTs_Runnable
==32065== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==32065== by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==32065== by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==32065== by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==32065== by 0x40E7C9: raccess_make_file_name /usr/local/google/src/freetype2/src/base/ftrfork.c:764
==32065== by 0x40E11E: raccess_guess_darwin_ufs_export /usr/local/google/src/freetype2/src/base/ftrfork.c:454
==32065== by 0x40DFF6: FT_Raccess_Guess /usr/local/google/src/freetype2/src/base/ftrfork.c:387
==32065== by 0x407E37: load_face_in_embedded_rfork /usr/local/google/src/freetype2/src/base/ftobjs.c:1808
==32065== by 0x40803F: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1899
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.
If that doesn't help, please report this bug to: http://www.valgrind.org
In the bug report, send all the above text, the valgrind
version, and what OS and version you are using. Thanks.
|