Wed 04 Aug 2010 12:46:50 PM UTC, comment #4:
Yeah.. it crashes only 64bit version for me as well (I have quite new sources from the svn)
$ gdb ./ftbench
(gdb) r -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
Program received signal SIGSEGV, Segmentation fault.
0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
207 *cur = FT_NEXT_SHORT( p );
(gdb) bt
#0 0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
#1 0x00000000004560e1 in sfnt_load_face (stream=0x6aca00, face=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/sfnt/sfobjs.c:630
#2 0x0000000000430890 in cff_face_init (stream=0x6aca00, cffface=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/cff/cffobjs.c:495
#3 0x00000000004063ed in open_face (driver=0x6abca0, stream=0x6aca00, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe368) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#4 0x0000000000407a20 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe3e0, face_index=0, aface=0x7fffffffe500) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2041
#5 0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe93d "SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf", face_index=0, aface=0x7fffffffe500)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#6 0x0000000000402319 in get_face (face=0x7fffffffe500) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#7 0x0000000000402603 in main (argc=1, argv=0x7fffffffe620) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740
$ valgrind ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax\,_byte_\[rax\].ttf
==32181== Memcheck, a memory error detector
==32181== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32181== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==32181== Command: ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
==32181==
==32181== Invalid read of size 1
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== Address 0x402a000 is not stack'd, malloc'd or (recently) free'd
==32181==
==32181==
==32181== Process terminating with default action of signal 11 (SIGSEGV)
==32181== Access not within mapped region at address 0x402A000
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== If you believe this happened as a result of a stack
==32181== overflow in your program's main thread (unlikely but
==32181== possible), you can try to increase the size of the
==32181== main thread stack using the --main-stacksize= flag.
==32181== The main thread stack size used in this run was 8388608.
==32181==
==32181== HEAP SUMMARY:
==32181== in use at exit: 96,428 bytes in 46 blocks
==32181== total heap usage: 52 allocs, 6 frees, 99,332 bytes allocated
==32181==
==32181== LEAK SUMMARY:
==32181== definitely lost: 0 bytes in 0 blocks
==32181== indirectly lost: 0 bytes in 0 blocks
==32181== possibly lost: 0 bytes in 0 blocks
==32181== still reachable: 96,428 bytes in 46 blocks
==32181== suppressed: 0 bytes in 0 blocks
==32181== Rerun with --leak-check=full to see details of leaked memory
==32181==
==32181== For counts of detected and suppressed errors, rerun with: -v
==32181== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault
|