bugThe FreeType Project - Bugs: bug #36832, NULL Pointer Dereference in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #36832: NULL Pointer Dereference in parse_charstrings

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Thu 12 Jul 2012 11:33:47 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.11

Wed 18 Jul 2012 08:42:02 AM UTC, comment #1: 

Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Thu 12 Jul 2012 11:33:47 AM UTC, original submission:  

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Stack trace:

--- cut ---
Program received signal SIGSEGV, Segmentation fault.
0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
1742          error = T1_Add_Table( swap_table, 0,
(gdb) where
#0  0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
#1  0x000000000042c688 in t1_load_keyword (face=0x7ffff74b4020, loader=0x7fffffffdbb0, field=0x5c5030)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:937
#2  0x000000000042e850 in parse_dict (face=0x7ffff74b4020, loader=0x7fffffffdbb0,
    base=0x7ffff74c2020 "    dup/Private 15 dict dup begin\n/RD{string currentfile exch readstring pop}executeonly def\n/ND{noaccess def}executeonly def\n/NP{noaccess put}executeonly def\n/BlueValues [-21 0 683 704 431 441 665 66"..., size=817)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1994
#3  0x000000000042ecbb in T1_Open_Face (face=0x7ffff74b4020) at freetype2/freetype-2.4.9/src/type1/t1load.c:2111
#4  0x000000000042f89e in T1_Face_Init (stream=0x7ffff747c0a0, t1face=0x7ffff74b4020, face_index=0, num_params=0, params=0x0)
    at freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#5  0x000000000040b5be in open_face (driver=0x7ffff7491de0, stream=0x7ffff747c0a0, face_index=0, num_params=0, params=0x0,
    aface=0x7fffffffe040) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1153
#6  0x000000000040cb8e in FT_Open_Face (library=0x7ffff749c020, args=0x7fffffffe0f0, face_index=0, aface=0x7fffffffe1c8)
    at freetype2/freetype-2.4.9/src/base/ftobjs.c:2080
#7  0x000000000040b6d2 in FT_New_Face (library=0x7ffff749c020, pathname=0x7fffffffe621 "/home/mjurczyk/tmp/font.bin",
    face_index=0, aface=0x7fffffffe1c8) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1215
#8  0x0000000000407830 in get_face (face=0x7fffffffe1c8) at freetype2/ft2demos-2.4.8/src/ftbench.c:624
#9  0x0000000000407b7e in main (argc=1, argv=0x7fffffffe2f0) at freetype2/ft2demos-2.4.8/src/ftbench.c:752
(gdb) print name_table->elements
$1 = (FT_Byte **) 0x0
(gdb) print name_table->elements[0]
Cannot access memory at address 0x0
(gdb) l
1737          /* 0 333 hsbw endchar */
1738          FT_Byte  notdef_glyph[] = { 0x8B, 0xF7, 0xE1, 0x0D, 0x0E };
1739          char*    notdef_name    = (char *)".notdef";
1740
1741
1742          error = T1_Add_Table( swap_table, 0,
1743                                name_table->elements[0],
1744                                name_table->lengths [0] );
1745          if ( error )
1746            goto Fail;
--- cut ---

Sample file attached.

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #26186:  parse_charstrings.bin added by j00ru (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-07-18 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.11
    2012-07-12 j00ru Attached File- Added parse_charstrings.bin, #26186

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code