Thu 12 Jul 2012 11:33:47 AM UTC, original submission:
Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).
Stack trace:
--- cut ---
Program received signal SIGSEGV, Segmentation fault.
0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
1742 error = T1_Add_Table( swap_table, 0,
(gdb) where
#0 0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
#1 0x000000000042c688 in t1_load_keyword (face=0x7ffff74b4020, loader=0x7fffffffdbb0, field=0x5c5030)
at freetype2/freetype-2.4.9/src/type1/t1load.c:937
#2 0x000000000042e850 in parse_dict (face=0x7ffff74b4020, loader=0x7fffffffdbb0,
base=0x7ffff74c2020 " dup/Private 15 dict dup begin\n/RD{string currentfile exch readstring pop}executeonly def\n/ND{noaccess def}executeonly def\n/NP{noaccess put}executeonly def\n/BlueValues [-21 0 683 704 431 441 665 66"..., size=817)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1994
#3 0x000000000042ecbb in T1_Open_Face (face=0x7ffff74b4020) at freetype2/freetype-2.4.9/src/type1/t1load.c:2111
#4 0x000000000042f89e in T1_Face_Init (stream=0x7ffff747c0a0, t1face=0x7ffff74b4020, face_index=0, num_params=0, params=0x0)
at freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#5 0x000000000040b5be in open_face (driver=0x7ffff7491de0, stream=0x7ffff747c0a0, face_index=0, num_params=0, params=0x0,
aface=0x7fffffffe040) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1153
#6 0x000000000040cb8e in FT_Open_Face (library=0x7ffff749c020, args=0x7fffffffe0f0, face_index=0, aface=0x7fffffffe1c8)
at freetype2/freetype-2.4.9/src/base/ftobjs.c:2080
#7 0x000000000040b6d2 in FT_New_Face (library=0x7ffff749c020, pathname=0x7fffffffe621 "/home/mjurczyk/tmp/font.bin",
face_index=0, aface=0x7fffffffe1c8) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1215
#8 0x0000000000407830 in get_face (face=0x7fffffffe1c8) at freetype2/ft2demos-2.4.8/src/ftbench.c:624
#9 0x0000000000407b7e in main (argc=1, argv=0x7fffffffe2f0) at freetype2/ft2demos-2.4.8/src/ftbench.c:752
(gdb) print name_table->elements
$1 = (FT_Byte **) 0x0
(gdb) print name_table->elements[0]
Cannot access memory at address 0x0
(gdb) l
1737 /* 0 333 hsbw endchar */
1738 FT_Byte notdef_glyph[] = { 0x8B, 0xF7, 0xE1, 0x0D, 0x0E };
1739 char* notdef_name = (char *)".notdef";
1740
1741
1742 error = T1_Add_Table( swap_table, 0,
1743 name_table->elements[0],
1744 name_table->lengths [0] );
1745 if ( error )
1746 goto Fail;
--- cut ---
Sample file attached.
|