bugThe FreeType Project - Bugs: bug #37905, NULL Pointer Dereference in...

 
 

bug #37905: NULL Pointer Dereference in bdf_free_font

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Wed 12 Dec 2012 09:55:19 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.11

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 15 Dec 2012 12:36:03 AM UTC, comment #1:

Fixed in git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 12 Dec 2012 09:55:19 AM UTC, original submission:

Crash tested with ftbench (freetype2 and ft2demos git upstream), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

(gdb) r
Starting program: ft2demos-2.4.10/bin/.libs/ftbench zgraphics_r400-12.bdf.SIGSEGV.dbf.2501
[Thread debugging using libthread_db enabled]
Using host libthread_db library "libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000000000074109e in bdf_free_font (font=<optimized out>)
at freetype2/src/bdf/bdflib.c:2543
2543 if ( font->props[i].format == BDF_ATOM )
(gdb) where
#0 0x000000000074109e in bdf_free_font (font=<optimized out>)
at freetype2/src/bdf/bdflib.c:2543
#1 0x0000000000747061 in bdf_load_font (stream=<optimized out>, extmemory=<optimized out>, opts=<optimized out>,
font=<optimized out>) at freetype2/src/bdf/bdflib.c:2504
#2 0x0000000000737a53 in BDF_Face_Init (stream=<optimized out>, bdfface=<optimized out>, face_index=<optimized out>,
num_params=<optimized out>, params=<optimized out>) at freetype2/src/bdf/bdfdrivr.c:367
#3 0x000000000044e086 in open_face (driver=<optimized out>, stream=<optimized out>, face_index=<optimized out>,
num_params=<optimized out>, params=<optimized out>, aface=<optimized out>)
at freetype2/src/base/ftobjs.c:1154
#4 0x0000000000449dc2 in FT_Open_Face (library=<optimized out>, args=<optimized out>, face_index=<optimized out>,
aface=<optimized out>) at freetype2/src/base/ftobjs.c:2082
#5 0x0000000000448070 in FT_New_Face (library=<optimized out>, pathname=<optimized out>, face_index=<optimized out>,
aface=<optimized out>) at freetype2/src/base/ftobjs.c:1216
#6 0x0000000000416757 in get_face (face=<optimized out>)
at ft2demos-2.4.10/src/ftbench.c:624
#7 0x0000000000418a73 in main (argc=<optimized out>, argv=<optimized out>)
at ft2demos-2.4.10/src/ftbench.c:752
(gdb) x/10i $rip
=> 0x74109e <bdf_free_font+2526>: cmpl $0x1,(%rax)
0x7410a4 <bdf_free_font+2532>: jne 0x741333 <bdf_free_font+3187>
0x7410aa <bdf_free_font+2538>: jmpq 0x7410af <bdf_free_font+2543>
0x7410af <bdf_free_font+2543>: mov 0x2f0(%rsp),%rax
0x7410b7 <bdf_free_font+2551>: shr $0x3,%rax
0x7410bb <bdf_free_font+2555>: movabs $0x100000000000,%rcx
0x7410c5 <bdf_free_font+2565>: or %rcx,%rax
0x7410c8 <bdf_free_font+2568>: cmpb $0x0,(%rax)
0x7410cb <bdf_free_font+2571>: je 0x7410de <bdf_free_font+2590>
0x7410d1 <bdf_free_font+2577>: mov 0x2f0(%rsp),%rdi
(gdb) info reg
rax 0x8 8
rbx 0x100000000000 17592186044416
rcx 0x8 8
rdx 0x0 0
rsi 0x100000000001 17592186044417
rdi 0x100000000000 17592186044416
rbp 0x7fffffffad70 0x7fffffffad70
rsp 0x7fffffffa8e0 0x7fffffffa8e0
r8 0x7fffffffa800 140737488332800
r9 0x1ffffffff504 35184372086020
r10 0x100000000000 17592186044416
r11 0x7ffff728ef6a 140737340043114
r12 0x7fffffffb4a0 140737488336032
r13 0x7fffffffb4e0 140737488336096
r14 0x7fffffffb420 140737488335904
r15 0x7fffffffb460 140737488335968
rip 0x74109e 0x74109e <bdf_free_font+2526>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb)

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #27078:  zgraphics_r400-12.bdf.SIGSEGV.dbf.2501 added by j00ru (13KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 15 Dec 2012 12:36:03 AM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.11
    Wed 12 Dec 2012 09:55:19 AM UTCj00ruAttached File-=>Added zgraphics_r400-12.bdf.SIGSEGV.dbf.2501, #27078

    Back to the top


    Powered by Savane 3.1-cleanup1