bugThe FreeType Project - Bugs: bug #33992, heap underflow in...

 
 

bug #33992: heap underflow in ft_stroke_border_close

Submitted by:  None
Submitted on:  Thu 11 Aug 2011 08:09:09 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.7

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 15 Aug 2011 03:37:07 PM UTC, comment #3:

Applied, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 15 Aug 2011 03:05:19 PM UTC, comment #2:

Werner,

The following is preferable to fix this:

--- old\ftstroke.c Sat Jul 02 11:37:30 2011
+++ new\ftstroke.c Mon Aug 15 15:46:29 2011
@@ -2222,9 +2222,13 @@
if ( error )
goto Exit;

- error = FT_Stroker_EndSubPath( stroker );
- if ( error )
- goto Exit;
+ /* don't try to end the path if no segments have been generated */
+ if ( !stroker->first_point )
+ {
+ error = FT_Stroker_EndSubPath( stroker );
+ if ( error )
+ goto Exit;
+ }

first = last + 1;
}

Thanks.

David %^>

David Bevan <davidbevan>
Fri 12 Aug 2011 06:54:41 AM UTC, comment #1:

David, please check the bug fix.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 11 Aug 2011 08:09:09 PM UTC, original submission:

At small zoom levels, border->start in ft_stroke_border_close can wrongly be -1, leading to a heap underflow at line 364 in ftstroke.c . This happens whenever stroker->first_point is TRUE in FT_Stroker_EndSubPath (which seems to happen at very small zoom levels).

Reliably reproduced with FreeType 2.4.6 as configured at http://code.google.com/p/sumatrapdf/source/browse/trunk#trunk%2Fext%2Ffreetype2 and with http://www.jaycar.com.au/images_uploaded/dcdcconv.pdf (http://code.google.com/p/sumatrapdf/source/detail?r=4365 fixes the crash for us).

If you need further information, feel free to contact me at -unavailable- .

BTW: This is likely the same issue as reported at http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg929267.html and https://bugs.archlinux.org/task/25332

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by davidbevan (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by wl
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 15 Aug 2011 03:37:07 PM UTCwlStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.7
    Fri 12 Aug 2011 06:54:41 AM UTCwlStatusNone=>In Progress
      Assigned toNone=>wl
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1