bugThe FreeType Project - Bugs: bug #37905, NULL Pointer Dereference in...

 
 

bug #37905: NULL Pointer Dereference in bdf_free_font

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Wed 12 Dec 2012 09:55:19 AM UTC  
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  2.4.11

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 15 Dec 2012 12:36:03 AM UTC, comment #1: 

Fixed in git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 12 Dec 2012 09:55:19 AM UTC, original submission:  

Crash tested with ftbench (freetype2 and ft2demos git upstream), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

(gdb) r
Starting program: ft2demos-2.4.10/bin/.libs/ftbench zgraphics_r400-12.bdf.SIGSEGV.dbf.2501
[Thread debugging using libthread_db enabled]
Using host libthread_db library "libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000000000074109e in bdf_free_font (font=<optimized out>)
    at freetype2/src/bdf/bdflib.c:2543
2543          if ( font->props[i].format == BDF_ATOM )
(gdb) where
#0  0x000000000074109e in bdf_free_font (font=<optimized out>)
    at freetype2/src/bdf/bdflib.c:2543
#1  0x0000000000747061 in bdf_load_font (stream=<optimized out>, extmemory=<optimized out>, opts=<optimized out>,
    font=<optimized out>) at freetype2/src/bdf/bdflib.c:2504
#2  0x0000000000737a53 in BDF_Face_Init (stream=<optimized out>, bdfface=<optimized out>, face_index=<optimized out>,
    num_params=<optimized out>, params=<optimized out>) at freetype2/src/bdf/bdfdrivr.c:367
#3  0x000000000044e086 in open_face (driver=<optimized out>, stream=<optimized out>, face_index=<optimized out>,
    num_params=<optimized out>, params=<optimized out>, aface=<optimized out>)
    at freetype2/src/base/ftobjs.c:1154
#4  0x0000000000449dc2 in FT_Open_Face (library=<optimized out>, args=<optimized out>, face_index=<optimized out>,
    aface=<optimized out>) at freetype2/src/base/ftobjs.c:2082
#5  0x0000000000448070 in FT_New_Face (library=<optimized out>, pathname=<optimized out>, face_index=<optimized out>,
    aface=<optimized out>) at freetype2/src/base/ftobjs.c:1216
#6  0x0000000000416757 in get_face (face=<optimized out>)
    at ft2demos-2.4.10/src/ftbench.c:624
#7  0x0000000000418a73 in main (argc=<optimized out>, argv=<optimized out>)
    at ft2demos-2.4.10/src/ftbench.c:752
(gdb) x/10i $rip
=> 0x74109e <bdf_free_font+2526>:       cmpl   $0x1,(%rax)
   0x7410a4 <bdf_free_font+2532>:       jne    0x741333 <bdf_free_font+3187>
   0x7410aa <bdf_free_font+2538>:       jmpq   0x7410af <bdf_free_font+2543>
   0x7410af <bdf_free_font+2543>:       mov    0x2f0(%rsp),%rax
   0x7410b7 <bdf_free_font+2551>:       shr    $0x3,%rax
   0x7410bb <bdf_free_font+2555>:       movabs $0x100000000000,%rcx
   0x7410c5 <bdf_free_font+2565>:       or     %rcx,%rax
   0x7410c8 <bdf_free_font+2568>:       cmpb   $0x0,(%rax)
   0x7410cb <bdf_free_font+2571>:       je     0x7410de <bdf_free_font+2590>
   0x7410d1 <bdf_free_font+2577>:       mov    0x2f0(%rsp),%rdi
(gdb) info reg
rax            0x8      8
rbx            0x100000000000   17592186044416
rcx            0x8      8
rdx            0x0      0
rsi            0x100000000001   17592186044417
rdi            0x100000000000   17592186044416
rbp            0x7fffffffad70   0x7fffffffad70
rsp            0x7fffffffa8e0   0x7fffffffa8e0
r8             0x7fffffffa800   140737488332800
r9             0x1ffffffff504   35184372086020
r10            0x100000000000   17592186044416
r11            0x7ffff728ef6a   140737340043114
r12            0x7fffffffb4a0   140737488336032
r13            0x7fffffffb4e0   140737488336096
r14            0x7fffffffb420   140737488335904
r15            0x7fffffffb460   140737488335968
rip            0x74109e 0x74109e <bdf_free_font+2526>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0
(gdb)

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #27078:  zgraphics_r400-12.bdf.SIGSEGV.dbf.2501 added by j00ru (13KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-12-15 wl StatusNone => Fixed
        PrivacyPrivate => Public
        Assigned toNone => wl
        Open/ClosedOpen => Closed
        Planned ReleaseNone => 2.4.11
    2012-12-12 j00ru Attached File- => Added zgraphics_r400-12.bdf.SIGSEGV.dbf.2501, #27078

    Back to the top


    Powered by Savane 3.5