Wed 22 Jan 2014 07:42:09 PM UTC, original submission:
There are three different use-of-uninitialized-memory conditions in psobjs.c, t42parse.c and t1load.c.
All of them have been reproduced with ftbench (with the -p command line option) compiled on Ubuntu amd64.
While only MSan log messages are shown below, the issues can also be reproduced with valgrind (confirmed), though with less informative warning messages.
MemorySanitizer logs:
==14397== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f5e51ed20e7 in FT_RoundFix freetype2/src/base/ftcalc.c:78
#1 0x7f5e527ddecc in ps_parser_load_field freetype2/src/psaux/psobjs.c:1213
#2 0x7f5e5238b1d2 in t42_load_keyword freetype2/src/type42/t42parse.c:1014
#3 0x7f5e5238820f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
#4 0x7f5e5237ef9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
#5 0x7f5e5236f576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
#6 0x7f5e51f11d70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f5e51f0b3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f5e51f0f6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f5e51eb21c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f5e51eade2f in main ft2demos-2.5.2/src/ftbench.c:918
Uninitialized value was created by an allocation of 'temp' in the stack frame of function 'ps_parser_load_field'
#0 0x7f5e527d9a30 in ps_parser_load_field freetype2/src/psaux/psobjs.c:1029
SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:78 FT_RoundFix
---------------------------------------------------------------------------------------------------------------------
==14517== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f93585fa1bf in FT_DivFix freetype2/src/base/ftcalc.c:560
#1 0x7f9358aab481 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:276
#2 0x7f9358aa956a in t42_load_keyword freetype2/src/type42/t42parse.c:981
#3 0x7f9358aa720f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
#4 0x7f9358a9df9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
#5 0x7f9358a8e576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
#6 0x7f9358630d70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f935862a3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f935862e6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f93585d11c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f93585cce2f in main ft2demos-2.5.2/src/ftbench.c:918
Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't42_parse_font_matrix'
#0 0x7f9358aaa2a0 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:251
SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix
---------------------------------------------------------------------------------------------------------------------
==14283== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f7a67d141bf in FT_DivFix freetype2/src/base/ftcalc.c:560
#1 0x7f7a67faca07 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1137
#2 0x7f7a67fa9964 in t1_load_keyword freetype2/src/type1/t1load.c:932
#3 0x7f7a67f9c829 in parse_dict freetype2/src/type1/t1load.c:1996
#4 0x7f7a67f8a035 in T1_Open_Face freetype2/src/type1/t1load.c:2104
#5 0x7f7a67f5efbe in T1_Face_Init freetype2/src/type1/t1objs.c:339
#6 0x7f7a67d4ad70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f7a67d443f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f7a67d486ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f7a67ceb1c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f7a67ce6e2f in main ft2demos-2.5.2/src/ftbench.c:918
Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't1_parse_font_matrix'
#0 0x7f7a67fab460 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1098
SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix
|