bugThe FreeType Project - Bugs: bug #36832, NULL Pointer Dereference in...

 
 

bug #36832: NULL Pointer Dereference in parse_charstrings

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Thu 12 Jul 2012 11:33:47 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.11

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 18 Jul 2012 08:42:02 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 12 Jul 2012 11:33:47 AM UTC, original submission:

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Stack trace:

--- cut ---
Program received signal SIGSEGV, Segmentation fault.
0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
1742 error = T1_Add_Table( swap_table, 0,
(gdb) where
#0 0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
#1 0x000000000042c688 in t1_load_keyword (face=0x7ffff74b4020, loader=0x7fffffffdbb0, field=0x5c5030)
at freetype2/freetype-2.4.9/src/type1/t1load.c:937
#2 0x000000000042e850 in parse_dict (face=0x7ffff74b4020, loader=0x7fffffffdbb0,
base=0x7ffff74c2020 " dup/Private 15 dict dup begin\n/RD{string currentfile exch readstring pop}executeonly def\n/ND{noaccess def}executeonly def\n/NP{noaccess put}executeonly def\n/BlueValues [-21 0 683 704 431 441 665 66"..., size=817)
at freetype2/freetype-2.4.9/src/type1/t1load.c:1994
#3 0x000000000042ecbb in T1_Open_Face (face=0x7ffff74b4020) at freetype2/freetype-2.4.9/src/type1/t1load.c:2111
#4 0x000000000042f89e in T1_Face_Init (stream=0x7ffff747c0a0, t1face=0x7ffff74b4020, face_index=0, num_params=0, params=0x0)
at freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#5 0x000000000040b5be in open_face (driver=0x7ffff7491de0, stream=0x7ffff747c0a0, face_index=0, num_params=0, params=0x0,
aface=0x7fffffffe040) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1153
#6 0x000000000040cb8e in FT_Open_Face (library=0x7ffff749c020, args=0x7fffffffe0f0, face_index=0, aface=0x7fffffffe1c8)
at freetype2/freetype-2.4.9/src/base/ftobjs.c:2080
#7 0x000000000040b6d2 in FT_New_Face (library=0x7ffff749c020, pathname=0x7fffffffe621 "/home/mjurczyk/tmp/font.bin",
face_index=0, aface=0x7fffffffe1c8) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1215
#8 0x0000000000407830 in get_face (face=0x7fffffffe1c8) at freetype2/ft2demos-2.4.8/src/ftbench.c:624
#9 0x0000000000407b7e in main (argc=1, argv=0x7fffffffe2f0) at freetype2/ft2demos-2.4.8/src/ftbench.c:752
(gdb) print name_table->elements
$1 = (FT_Byte **) 0x0
(gdb) print name_table->elements[0]
Cannot access memory at address 0x0
(gdb) l
1737 /* 0 333 hsbw endchar */
1738 FT_Byte notdef_glyph[] = { 0x8B, 0xF7, 0xE1, 0x0D, 0x0E };
1739 char* notdef_name = (char *)".notdef";
1740
1741
1742 error = T1_Add_Table( swap_table, 0,
1743 name_table->elements[0],
1744 name_table->lengths [0] );
1745 if ( error )
1746 goto Fail;
--- cut ---

Sample file attached.

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #26186:  parse_charstrings.bin added by j00ru (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 18 Jul 2012 08:42:02 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.11
    Thu 12 Jul 2012 11:33:47 AM UTCj00ruAttached File-=>Added parse_charstrings.bin, #26186

    Back to the top


    Powered by Savane 3.1-cleanup1