Sun 13 Sep 2015 09:17:48 PM UTC, comment #2:
I am pretty sure, just re-confirmed with the following .sh script and valgrind.
==34337== Invalid read of size 1
==34337== at 0x422651: T1_Get_Private_Dict (t1parse.c:377)
==34337== by 0x422651: T1_Open_Face (t1load.c:2118)
==34337== by 0x422F40: T1_Face_Init (t1objs.c:339)
==34337== by 0x40FA41: open_face (ftobjs.c:1166)
==34337== by 0x4112F2: FT_Open_Face (ftobjs.c:2156)
==34337== by 0x411908: FT_New_Memory_Face (ftobjs.c:1256)
==34337== by 0x4089D6: TestOneInput (repro.c:10)
==34337== by 0x408AF7: main (repro.c:28)
==34337== Address 0x69c9360 is 0 bytes after a block of size 256 alloc'd
==34337== at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==34337== by 0x408ACB: main (repro.c:26)
#!/bin/bash
git clone git://git.sv.nongnu.org/freetype/freetype2.git
cd freetype2/
./autogen.sh
./configure
make -j
cat << EOF > repro.c
#include <ft2build.h>
#include FT_FREETYPE_H
#include <assert.h>
#include <stdlib.h>
#include <string.h>
static FT_Library library;
void TestOneInput(const unsigned char *data, size_t size) {
FT_Face face;
if (size < 1) return;
if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
FT_Done_Face(face);
}
}
unsigned char a[1 << 24];
int main(int argc, char **argv) {
if (FT_Init_FreeType(&library)) {
printf("Could not initialize library.\n");
return 1;
}
assert(argc == 2);
FILE *f = fopen(argv[1], "r");
assert(f);
size_t n = fread(a, 1, sizeof(a), f);
assert(n > 0);
fclose(f);
unsigned char b = (unsigned char )malloc(n);
memcpy(b, a, n);
TestOneInput(b, n);
free(b);
}
EOF
gcc -g repro.c -Iinclude ./objs/.libs/libfreetype.a -lbz2 -lz -lpng -lharfbuzz -o repro_vg
cat << EOF | base64 --decode > input
JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==
EOF
valgrind ./repro_vg input
|