Mon 05 Jul 2010 10:08:20 PM UTC, original submission:
I think that's really the last one :)
gcc -O0 -g
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), Linux amd64
File: http://alt.swiecki.net/j/f/sigabrt28.ttf
The address passed to realloc() seems valid, I debugged it with simple memory debugger (a preloaded lib intercepting malloc, free, calloc, realloc), and it's been allocated, so the only reasonable answer to this for me must be corruption of the heap metadata (typically buffer overflow)
$ MALLOC_CHECK_=3 LD_PRELOAD=./libdalloc.so ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf | grep 6af500
MALLOC: SIZE: 8, RET: 0x6af500
REALLOC: PTR: 0x6af500 SIZE: 16, RET: 0x6af500
- glibc detected *** ./ftbench: realloc(): invalid pointer: 0x00000000006af560 ***
======= Backtrace: =========
...
and the full output w/o libdalloc.so
$ MALLOC_CHECK_=3 ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
Load : *** glibc detected *** ./ftbench: realloc(): invalid pointer: 0x00000000006af560 ***
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7ffff78b95b6]
/lib/libc.so.6(+0x7ed33)[0x7ffff78c0d33]
./ftbench[0x47ed95]
./ftbench[0x410238]
./ftbench[0x4100dc]
./ftbench[0x4045fc]
./ftbench[0x412c73]
./ftbench[0x4150b5]
./ftbench[0x416526]
./ftbench[0x4118bf]
./ftbench[0x405a52]
./ftbench[0x4017c4]
./ftbench[0x4016fe]
./ftbench[0x40275f]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ffff7860c4d]
./ftbench[0x4014e9]
======= Memory map: ========
00400000-004a6000 r-xp 00000000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a5000-006a6000 r--p 000a5000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a6000-006a7000 rw-p 000a6000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a7000-006c8000 rw-p 00000000 00:00 0 [heap]
7ffff762b000-7ffff7641000 r-xp 00000000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7641000-7ffff7840000 ---p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7840000-7ffff7841000 r--p 00015000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7841000-7ffff7842000 rw-p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7842000-7ffff79bc000 r-xp 00000000 08:01 1352099 /lib/libc-2.11.1.so
7ffff79bc000-7ffff7bbb000 ---p 0017a000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbb000-7ffff7bbf000 r--p 00179000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbf000-7ffff7bc0000 rw-p 0017d000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bc0000-7ffff7bc5000 rw-p 00000000 00:00 0
7ffff7bc5000-7ffff7bdb000 r-xp 00000000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7bdb000-7ffff7dda000 ---p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7dda000-7ffff7ddb000 r--p 00015000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddb000-7ffff7ddc000 rw-p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0
7ffff7fee000-7ffff7fef000 rw-p 00000000 00:00 0
7ffff7fef000-7ffff7ff9000 r--p 00000000 08:06 25976849 /usr/local/google/fuzz/ttf/SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
valgrind:
$ valgrind ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205== Memcheck, a memory error detector
==23205== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==23205== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==23205== Command: ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205==
==23205== Invalid read of size 1
==23205== at 0x41EE93: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6773
==23205== by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205== by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205== by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205== by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205== by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205== by 0x40275E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:782
==23205== Address 0x53d28f0 is 0 bytes after a block of size 64 alloc'd
==23205== at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205== by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205== by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205== by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205== by 0x40463A: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:225
==23205== by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205== by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205== Invalid write of size 8
==23205== at 0x41ECEE: _iup_worker_interpolate /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6700
==23205== by 0x41EF1F: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6791
==23205== by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205== by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205== by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205== by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205== by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205== Address 0x53d2870 is 0 bytes after a block of size 1,024 alloc'd
==23205== at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205== by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205== by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205== by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205== by 0x4045FB: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
==23205== by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205== by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205==
==23205== HEAP SUMMARY:
==23205== in use at exit: 0 bytes in 0 blocks
==23205== total heap usage: 2,031 allocs, 2,031 frees, 340,840 bytes allocated
==23205==
==23205== All heap blocks were freed -- no leaks are possible
==23205==
==23205== For counts of detected and suppressed errors, rerun with: -v
==23205== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 4 from 0)
gdb:
$ MALLOC_CHECK_=3 gdb ./ftbench
(gdb) r -c 1 sigabrt28.ttf
Program received signal SIGABRT, Aborted.
0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0 0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff78795c0 in *__GI_abort () at abort.c:92
#2 0x00007ffff78af4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff78b95b6 in malloc_printerr (action=3, str=0x7ffff7989bee "realloc(): invalid pointer", ptr=<value optimized out>) at malloc.c:6264
#4 0x00007ffff78c0d33 in realloc_check (oldmem=0x6af560, bytes=1280, caller=<value optimized out>) at hooks.c:330
#5 0x000000000047ed95 in ft_realloc (memory=0x6a7010, cur_size=1024, new_size=1280, block=0x6af560) at builds/unix/ftsystem.c:135
#6 0x0000000000410238 in ft_mem_qrealloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe28c) at /usr/local/google/src/freetype2/src/base/ftutil.c:154
#7 0x00000000004100dc in ft_mem_realloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe2e8) at /usr/local/google/src/freetype2/src/base/ftutil.c:101
#8 0x00000000004045fc in FT_GlyphLoader_CheckPoints (loader=0x6add50, n_points=77, n_contours=0) at /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
#9 0x0000000000412c73 in TT_Load_Simple_Glyph (load=0x7fffffffe550) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
#10 0x00000000004150b5 in load_truetype_glyph (loader=0x7fffffffe550, glyph_index=8, recurse_count=0, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
#11 0x0000000000416526 in TT_Load_Glyph (size=0x6ade10, glyph=0x6adbb0, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
#12 0x00000000004118bf in Load_Glyph (ttslot=0x6adbb0, ttsize=0x6ade10, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
#13 0x0000000000405a52 in FT_Load_Glyph (face=0x6acb40, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#14 0x00000000004017c4 in test_load (timer=0x7fffffffe870, face=0x6acb40, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:219
#15 0x00000000004016fe in benchmark (face=0x6acb40, test=0x7fffffffe8e0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#16 0x000000000040275f in main (argc=1, argv=0x7fffffffea50) at /usr/local/google/src/freetype2-demos/src/ftbench.c:782
|