Fri 06 Aug 2010 05:16:18 AM UTC, comment #3:
Just I've fixed the issue on GIT head, by following patch.
Please test.
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 9dce576..13c126f 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1574,6 +1574,7 @@
FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
i, offsets[i], rlen, flags ));
+ /* postpone the check of rlen longer than buffer until FT_Stream_Read() */
if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */
continue;
@@ -1613,6 +1614,10 @@
pfb_data[pfb_pos++] = 0;
}
+ error = FT_Err_Cannot_Open_Resource;
+ if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
+ goto Exit2;
+
error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
if ( error )
goto Exit2;
|
Thu 05 Aug 2010 01:46:39 PM UTC, original submission:
Font: http://alt.swiecki.net/j/f/sigsegv31.ttf
$ gdb ./ftbench
(gdb) r -c 1 sigsegv31.ttf
Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:267
267 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S
(gdb) bt
#0 memcpy () at ../sysdeps/x86_64/memcpy.S:267
#1 0x000000000040e4de in FT_Stream_ReadAt (stream=0x6aca00, pos=159050, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2 0x000000000040e428 in FT_Stream_Read (stream=0x6aca00, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3 0x0000000000406e99 in Mac_Read_POST_Resource (library=0x6a7040, stream=0x6aca00, offsets=0x6ad1f0, resource_cnt=120, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1616
#4 0x0000000000407283 in IsMacResource (library=0x6a7040, stream=0x6aca00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1747
#5 0x00000000004074f6 in IsMacBinary (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1822
#6 0x000000000040772e in load_mac_face (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1922
#7 0x0000000000407b44 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2083
#8 0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe979 "sigsegv31.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#9 0x0000000000402319 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#10 0x0000000000402603 in main (argc=1, argv=0x7fffffffe660) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740
$ valgrind ./ftbench -c 1 sigsegv31.ttf
==30068== Memcheck, a memory error detector
==30068== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==30068== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==30068== Command: ./ftbench -c 1 sigsegv31.ttf
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E5D: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9ab is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E67: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9aa is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E72: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9a9 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E7D: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9a8 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29EBC: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9ad is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Use of uninitialised value of size 8
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068==
==30068== Invalid write of size 8
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068==
==30068== Process terminating with default action of signal 11 (SIGSEGV)
==30068== Access not within mapped region at address 0x0
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== If you believe this happened as a result of a stack
==30068== overflow in your program's main thread (unlikely but
==30068== possible), you can try to increase the size of the
==30068== main thread stack using the --main-stacksize= flag.
==30068== The main thread stack size used in this run was 8388608.
==30068==
==30068== HEAP SUMMARY:
==30068== in use at exit: 22,608 bytes in 39 blocks
==30068== total heap usage: 67 allocs, 28 frees, 213,694 bytes allocated
==30068==
==30068== LEAK SUMMARY:
==30068== definitely lost: 0 bytes in 0 blocks
==30068== indirectly lost: 0 bytes in 0 blocks
==30068== possibly lost: 0 bytes in 0 blocks
==30068== still reachable: 22,608 bytes in 39 blocks
==30068== suppressed: 0 bytes in 0 blocks
==30068== Rerun with --leak-check=full to see details of leaked memory
==30068==
==30068== For counts of detected and suppressed errors, rerun with: -v
==30068== Use --track-origins=yes to see where uninitialised values come from
==30068== ERROR SUMMARY: 80166 errors from 7 contexts (suppressed: 4 from 4)
Segmentation fault
|