Wed 12 Dec 2012 09:55:19 AM UTC, original submission:
Crash tested with ftbench (freetype2 and ft2demos git upstream), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).
Log from ASAN build:
(gdb) r
Starting program: ft2demos-2.4.10/bin/.libs/ftbench zgraphics_r400-12.bdf.SIGSEGV.dbf.2501
[Thread debugging using libthread_db enabled]
Using host libthread_db library "libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x000000000074109e in bdf_free_font (font=<optimized out>)
at freetype2/src/bdf/bdflib.c:2543
2543 if ( font->props[i].format == BDF_ATOM )
(gdb) where
#0 0x000000000074109e in bdf_free_font (font=<optimized out>)
at freetype2/src/bdf/bdflib.c:2543
#1 0x0000000000747061 in bdf_load_font (stream=<optimized out>, extmemory=<optimized out>, opts=<optimized out>,
font=<optimized out>) at freetype2/src/bdf/bdflib.c:2504
#2 0x0000000000737a53 in BDF_Face_Init (stream=<optimized out>, bdfface=<optimized out>, face_index=<optimized out>,
num_params=<optimized out>, params=<optimized out>) at freetype2/src/bdf/bdfdrivr.c:367
#3 0x000000000044e086 in open_face (driver=<optimized out>, stream=<optimized out>, face_index=<optimized out>,
num_params=<optimized out>, params=<optimized out>, aface=<optimized out>)
at freetype2/src/base/ftobjs.c:1154
#4 0x0000000000449dc2 in FT_Open_Face (library=<optimized out>, args=<optimized out>, face_index=<optimized out>,
aface=<optimized out>) at freetype2/src/base/ftobjs.c:2082
#5 0x0000000000448070 in FT_New_Face (library=<optimized out>, pathname=<optimized out>, face_index=<optimized out>,
aface=<optimized out>) at freetype2/src/base/ftobjs.c:1216
#6 0x0000000000416757 in get_face (face=<optimized out>)
at ft2demos-2.4.10/src/ftbench.c:624
#7 0x0000000000418a73 in main (argc=<optimized out>, argv=<optimized out>)
at ft2demos-2.4.10/src/ftbench.c:752
(gdb) x/10i $rip
=> 0x74109e <bdf_free_font+2526>: cmpl $0x1,(%rax)
0x7410a4 <bdf_free_font+2532>: jne 0x741333 <bdf_free_font+3187>
0x7410aa <bdf_free_font+2538>: jmpq 0x7410af <bdf_free_font+2543>
0x7410af <bdf_free_font+2543>: mov 0x2f0(%rsp),%rax
0x7410b7 <bdf_free_font+2551>: shr $0x3,%rax
0x7410bb <bdf_free_font+2555>: movabs $0x100000000000,%rcx
0x7410c5 <bdf_free_font+2565>: or %rcx,%rax
0x7410c8 <bdf_free_font+2568>: cmpb $0x0,(%rax)
0x7410cb <bdf_free_font+2571>: je 0x7410de <bdf_free_font+2590>
0x7410d1 <bdf_free_font+2577>: mov 0x2f0(%rsp),%rdi
(gdb) info reg
rax 0x8 8
rbx 0x100000000000 17592186044416
rcx 0x8 8
rdx 0x0 0
rsi 0x100000000001 17592186044417
rdi 0x100000000000 17592186044416
rbp 0x7fffffffad70 0x7fffffffad70
rsp 0x7fffffffa8e0 0x7fffffffa8e0
r8 0x7fffffffa800 140737488332800
r9 0x1ffffffff504 35184372086020
r10 0x100000000000 17592186044416
r11 0x7ffff728ef6a 140737340043114
r12 0x7fffffffb4a0 140737488336032
r13 0x7fffffffb4e0 140737488336096
r14 0x7fffffffb420 140737488335904
r15 0x7fffffffb460 140737488335968
rip 0x74109e 0x74109e <bdf_free_font+2526>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb)
|