bugThe FreeType Project - Bugs: bug #47500, NULL pointer dereference in...

 
 

bug #47500: NULL pointer dereference in Draw_Sweep (ftraster.c)

Submitted by:  None
Submitted on:  Tue 22 Mar 2016 05:02:34 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 23 Mar 2016 06:33:32 AM UTC, comment #1:

Fixed in git, thanks. Too large outlines are now properly rejected.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 22 Mar 2016 05:02:34 PM UTC, original submission:

The freetype rastering code (ftraster.c) crashes when a particular FT_Outline_ structure is used in ft_black_render() through ft_standard_raster.raster_render(). This is due to a null pointer dereference happening inside the Draw_Sweep routine. gdb stack trace below:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000404aef in Draw_Sweep (worker=0x7fffffff9670) at ftraster.c:2760
2760 x2 = P_Right->X;
(gdb) bt
#0 0x0000000000404aef in Draw_Sweep (worker=0x7fffffff9670) at ftraster.c:2760
#1 0x000000000040500c in Render_Single_Pass (worker=0x7fffffff9670, flipped=0 '\000') at ftraster.c:2946
#2 0x00000000004051c0 in Render_Glyph (worker=0x7fffffff9670) at ftraster.c:3008
#3 0x0000000000405546 in ft_black_render (raster=0x6072f0 <ft_black_new(void, FT_RasterRec_*)::the_raster>, params=0x7fffffffdeb0) at ftraster.c:3184
#4 0x00000000004058c8 in main () at example3.cpp:176

The crash is reproducible on HEAD, using the attached program, which is a version of http://www.freetype.org/freetype2/docs/tutorial/example3.cpp modified to use the specific FT_Outline_ structure that triggers the crash.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36725:  ftraster-crash.cpp added by None (5KiB - application/octet-stream - The program that reproduces the crash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 23 Mar 2016 06:33:32 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.4
    Tue 22 Mar 2016 05:02:34 PM UTCNoneAttached File-=>Added ftraster-crash.cpp, #36725

    Back to the top


    Powered by Savane 3.1-cleanup1