bugThe FreeType Project - Bugs: bug #39269, Memory leak on realloc() failure...

 
 

bug #39269: Memory leak on realloc() failure while loading glyph

Submitted by:  Andrew Church <achurch>
Submitted on:  Mon 17 Jun 2013 02:59:23 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 18 Jun 2013 08:57:19 AM UTC, comment #2:

git HEAD now passes my tests, thanks.

I actually tried your suggested change (free the old pointer on realloc() failure) first, but I got segfaults when testing, so I assumed that the old pointers are reused in some cases and didn't dig any deeper. I agree that if it's safe, that would indeed be a simpler solution.

Andrew Church <achurch>
Tue 18 Jun 2013 08:24:22 AM UTC, comment #1:

Thanks for the report; I've fixed it, please test.

Note that you are completely mistaken with your analysis of ft_mem_qrealloc and friends, I think: As with all FreeType reallocation functions, the original array doesn't get touched if reallocation fails, so you can simply free the array in case of error.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 17 Jun 2013 02:59:23 PM UTC, original submission:

If an out-of-memory situation occurs while loading a glyph, certain internal arrays can leak because the original array pointer is not preserved across FT_RENEW_ARRAY() failure.

Patch against current git attached.

FYI, this is just one instance of what seems to be a more general problem, which is that the memory reallocation macros overwrite an existing pointer with the realloc() result even if the reallocation fails. I'm not familiar enough with the FreeType code to competently suggest a solution, but my first thought would be to rewrite the ft_mem_{realloc,qrealloc} functions to take a pointer to the block pointer and update the value itself, then return a boolean success/failure (or error code) instead of the new pointer -- something like:

Andrew Church <achurch>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by achurch (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 18 Jun 2013 08:24:22 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5
    Mon 17 Jun 2013 02:59:23 PM UTCachurchAttached File-=>Added freetype-ftgloadr-oom-fixes.diff, #28334

    Back to the top


    Powered by Savane 3.1-cleanup1