bugThe FreeType Project - Bugs: bug #35660, Division by zero in cff_face_init...


You are not allowed to post comments on this tracker with your current authentication level.

bug #35660: Division by zero in cff_face_init => FT_DivFix

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Tue 28 Feb 2012 11:28:13 AM UTC
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.9

Sun 04 Mar 2012 11:03:03 AM UTC, comment #2: 

The crash no longer occurs, seems OK. Also, and as expected, I've been unable to find any more issues at this time, so there are no more upcoming reports from me. Thanks for your prompt fixes.

Mateusz Jurczyk <j00ru>
Group Member
Sat 03 Mar 2012 11:36:48 AM UTC, comment #1: 

This should be fixed now.  Please test the current git.

Werner LEMBERG <wl>
Group administrator
Tue 28 Feb 2012 11:28:13 AM UTC, original submission:  

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Because of the nature of the vulnerability (64-to-32 bit integer truncation), the issue might only be reproducible on 64-bit platforms.


(gdb) r tmp/freetype_run2/30000.11181.otf.9f7.35
Starting program: ft2demos-2.4.8/bin/ftbench tmp/freetype_run2/30000.11181.otf.9f7.35
tt_face_build_cmaps: broken cmap sub-table ignored
tt_face_build_cmaps: broken cmap sub-table ignored

Program received signal SIGFPE, Arithmetic exception.
0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000) at freetype2/src/base/ftcalc.c:555
555         q = (FT_UInt32)( (a << 16) + (b >> 1) ) / (FT_UInt32)b;
(gdb) where
#0  0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000)
    at freetype2/src/base/ftcalc.c:555
#1  0x0000000000437ae7 in cff_face_init (stream=0x6ce960, cffface=0x6cec00, face_index=0, num_params=0, params=0x0)
    at freetype2/src/cff/cffobjs.c:659
#2  0x0000000000407f70 in open_face (driver=0x6cdd70, stream=0x6ce960, face_index=0, num_params=0, params=0x0,
    aface=0x7fffffffe108) at freetype2/src/base/ftobjs.c:1153
#3  0x00000000004097f4 in FT_Open_Face (library=0x6c9040, args=0x7fffffffe180, face_index=0, aface=0x7fffffffe2a0)
    at freetype2/src/base/ftobjs.c:2080
#4  0x000000000040808d in FT_New_Face (library=0x6c9040,
    pathname=0x7fffffffe654 "tmp/freetype_run2/30000.11181.otf.9f7.35", face_index=0,
    aface=0x7fffffffe2a0) at freetype2/src/base/ftobjs.c:1215
#5  0x0000000000402303 in get_face (face=0x7fffffffe2a0) at src/ftbench.c:624
#6  0x00000000004025f5 in main (argc=1, argv=0x7fffffffe3b0) at src/ftbench.c:752

Mateusz Jurczyk <j00ru>
Group Member


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #25206:  30000.11181.otf.9f7.35 added by j00ru (244KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-03-03 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.9
    2012-02-28 j00ru Attached File- Added 30000.11181.otf.9f7.35, #25206

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code