bugThe FreeType Project - Bugs: bug #52955, FT_Get_MM_Var returns garbage when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52955: FT_Get_MM_Var returns garbage when called repeatedly for a single FT_Face

Submitter:  Jonathan Kew <jfkthame>
Submitted:  Mon 22 Jan 2018 08:38:55 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.9.1

Fri 26 Jan 2018 10:18:24 PM UTC, comment #4: 

Oops!  Now it is.

Werner LEMBERG <wl>
Group administrator
Fri 26 Jan 2018 09:52:11 PM UTC, comment #3: 

Did the commit get pushed? I wanted to verify but I don't see the commit in the savannah repo yet?

bungeman <bungeman>
Fri 26 Jan 2018 09:23:47 PM UTC, comment #2: 

Thanks a lot!  Committed.

Werner LEMBERG <wl>
Group administrator
Fri 26 Jan 2018 04:52:16 PM UTC, comment #1: 

I can confirm, and the cause appears to be that

face->blend->num_axis

is never set.

While probably not ideal, simply applying


diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 6f456cf8c..340aa844e 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -2049,6 +2049,7 @@
         goto Exit;

       num_axes = fvar_head.axisCount;
+      face->blend->num_axis = num_axes;
     }
     else
       num_axes = face->blend->num_axis;


fixes the reproduction case.

bungeman <bungeman>
Mon 22 Jan 2018 08:38:55 PM UTC, original submission:  

I'm seeing what seems to be a bug whereby FT_Get_MM_Var returns a correct FT_MM_Var record only the first time it is called for a given face. Calling it again returns a struct where the various internal pointer fields seem to point to "random" (uninitialized? already-freed?) memory.

See attached test program. Compile with a command like:


clang++ --std=c++14 `freetype-config --cflags` `freetype-config --libs` ft-get-mm-var.cpp -o ft-get-mm-var


or equivalent.

When run, this loads a face, requests its FT_MM_Var info, and prints a simple report. Then it requests the FT_MM_Var again, and reports again. Expected result is that the same info will be reported both times.

However, example output:


./ft-get-mm-var
Using FreeType version 2.9.0
Using font file "AvenirNext_Variable.ttf"
FT_MM_Var record at 0x7fb9e0c0dee0
axis 0: tag 'wght', min 400.000, default 400.000, max 900.000
axis 1: tag 'wdth', min 75.000, default 100.000, max 100.000

FT_MM_Var record at 0x7fb9e0c0dee0
axis 0: tag '??߀', min 2142888128.859, default 2142888128.873, max 400.000
axis 1: tag '??߀', min 2142888128.859, default 2142888128.873, max 100.000


The exact values of the "junk" in the second report varies on each run, suggesting that it is accessing freed or uninitialized memory.

Note that commenting out the FT_Done_MM_Var call in between the two reports does not help. In this case, the second call allocates a structure at a different address (whereas in the example above, it ended up at the exact same address, where the first one had been freed); however, it still reports junk from axis array.

The array of named instances (not reported by this test program) shows a similar problem.

Jonathan Kew <jfkthame>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #43030:  ft-get-mm-var.cpp added by jfkthame (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by bungeman (Posted a comment)
  • -email is unavailable- added by jfkthame (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-01-26 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.9.1
    2018-01-26 wl Item GroupNone Incorrect behaviour
    2018-01-22 jfkthame Attached File- Added ft-get-mm-var.cpp, #43030

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code