bugThe FreeType Project - Bugs: bug #52357, MemorySanitizer:...

 
 

bug #52357: MemorySanitizer: use-of-uninitialized-value in ftgrays.c:gray_set_cell

Submitted by:  bungeman <bungeman>
Submitted on:  Mon 06 Nov 2017 09:39:52 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Alexei Podtelezhnikov <podtelez>Open/Closed: Closed
Planned Release: 2.8.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 07 Nov 2017 02:36:26 AM UTC, comment #2:

Fixed in git,

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Mon 06 Nov 2017 10:34:00 PM UTC, comment #1:

I am pretty sure that you are correct. Putting !ras.invalid check up front should fix this issue.

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Mon 06 Nov 2017 09:39:52 PM UTC, original submission:

When rolling FreeType in Chromium over the following four commits

https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+log/94f6d57a4c42..816516360c76

the following was reported

==4838==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x1d6f1a0 in gray_set_cell third_party/freetype/src/src/smooth/ftgrays.c:586:21
#1 0x1d6f1a0 in gray_move_to third_party/freetype/src/src/smooth/ftgrays.c:1195:0
#2 0x1c31aff in FT_Outline_Decompose third_party/freetype/src/src/base/ftoutln.c:143:15
#3 0x1d6e752 in gray_convert_glyph_inner third_party/freetype/src/src/smooth/ftgrays.c:1717:15
#4 0x1d6c32f in gray_convert_glyph third_party/freetype/src/src/smooth/ftgrays.c:1790:17
#5 0x1d6c32f in gray_raster_render third_party/freetype/src/src/smooth/ftgrays.c:1931:0
#6 0x1c32f25 in FT_Outline_Render third_party/freetype/src/src/base/ftoutln.c:640:15
#7 0x1c32f25 in FT_Outline_Get_Bitmap third_party/freetype/src/src/base/ftoutln.c:681:0
#8 0x6f7c0bf in SkScalerContext_FreeType_Base::generateGlyphImage(FT_FaceRec_*, SkGlyph const&, SkMatrix const&) third_party/skia/src/ports/SkFontHost_FreeType_common.cpp:504:17

I'm suspecting something in "[smooth] Improve complex rendering at high ppem." (91015cb41d8) since that changed this line. It appears that one of ras.area or ras.cover hasn't been set yet. I'll see about creating a smaller reproducing test case than building Chromium with the above roll with msan and running.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Updated the item)
  • -unavailable- added by podtelez (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 07 Nov 2017 05:47:02 AM UTCwlAssigned toNone=>podtelez
      Planned ReleaseNone=>2.8.2
    Tue 07 Nov 2017 02:36:26 AM UTCpodtelezStatusNone=>Fixed
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1