bugThe FreeType Project - Bugs: bug #23204, freetype2 crashes


You are not allowed to post comments on this tracker with your current authentication level.

bug #23204: freetype2 crashes

Submitted by:  None
Submitted on:  Thu 08 May 2008 01:09:14 PM UTC  
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  suzuki toshiya <mpsuzuki> Open/Closed:  Closed
Planned Release:  2.3.6

Thu 22 May 2008 03:09:54 AM UTC, comment #2: 

Just I've checked that ftmac.c functionalities on x86_64.
The reported bug is reproduced by fontconfig & freetype
bundled to Mac OS X 10.5. The bundled freetype seems to be
freetype-2.3.5 which is released before Mac OS X 10.5,
thus, it was not ready for Mac OS X 10.5.

Genuine Suitcase font does not make freetype-2.3.5 crashed,
but any ".dfont" files make it crashed. freetype-2.3.5 with
proposed patch does not crash, but still it cannot load any
".dfont" files.

The latest FreeType2 on CVS is already fixed for Mac OS X
10.5, and it can load all ".dfont" in Mac OS X 10.5 even
without the proposed patch. Thus, the complete solution of
the problem is that Apple updates freetype-2.3.5 by latest

Anyway, "*aface" is still a pointer to another pointer
(typed FT_FaceRec*), so checking "*aface != NULL" is not
bad idea. I leave proposed patch as applied, although it
is not required anymore.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Tue 20 May 2008 08:04:27 AM UTC, comment #1: 

Thank you for hunting a bug in ftmac.c and the patch to fix it.
The patch looks good and I applied it on CVS.

I think the initialized-but-unfinished aface is returned by
FT_New_Face_From_FOND(), so the proposed patch is not terminal
fix. I have to track more detail of the origin of the bug.

The crash on x86_64 arch is now fixed, but the functionality
of ftmac.c on x86_64 arch is still questionable. As soon as
I can access x86_64 Macintosh, I will improve
FT_New_Face_From_FOND() not to return invalid aface.
Thus I leave this bug for a while (within a few weeks),
please wait.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Thu 08 May 2008 01:09:14 PM UTC, original submission:  

When using the inbuilt freetype2 through fontconfig, a program will crash when linked and run against 64-bit Intel Leopard.


1. Compile the enclosed program as follows:
gcc -I/usr/X11/include -L/usr/X11/lib -lfontconfig -o testfontconfig -arch x86_64 testfontconfig.c
2. Remove any user font cache:
rm -rf ~/.fontconfig
3. Run the program.


It crashes with a Segmentation Fault.


If you use -arch i386, -arch ppc or -arch ppc64, the problem does not occur.


Running this in gdb produces the following backtrace:

#0  0x0000000100053783 in FT_New_Face_From_Suitcase ()
#1  0x00000001000539c2 in FT_New_Face_From_Resource ()
#2  0x0000000100053a39 in FT_New_Face ()
#3  0x000000010000f753 in FcFreeTypeQuery ()
#4  0x000000010000e652 in FcFileScanFontConfig ()
#5  0x000000010000e7a5 in FcFileScanConfig ()
#6  0x000000010000eaa7 in FcDirCacheScan ()
#7  0x000000010000eb82 in FcDirCacheRead ()
#8  0x00000001000071fb in FcConfigAddDirList ()
#9  0x00000001000072b9 in FcConfigBuildFonts ()
#10 0x0000000100013344 in FcInitLoadConfigAndFonts ()
#11 0x000000010001338e in FcInit ()
#12 0x0000000100000f8f in main ()

FT_New_Face_From_Suitcase appears to crash because of a write to a null pointer because it can't find any FOND resources in the file and the code assumes at least one is found. The enclosed patch ftmac.c.patch fixes the immediate problem (preventing the crash because of a null pointer), but doesn't address the underlying cause.



Attached Files
file #15641:  freetype.patch added by None (455B)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by mpsuzuki (Posted a comment)
  • -email is unavailable- added by wl (Updated the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-09-15 wl StatusNone => Fixed
    2008-05-22 mpsuzuki Open/ClosedOpen => Closed
    2008-05-20 mpsuzuki Planned ReleaseNone => 2.3.6
    2008-05-08 wl Assigned toNone => mpsuzuki
    2008-05-08 None Attached File- => Added testfontconfig.c, #15640
        Attached File- => Added freetype.patch, #15641

    Back to the top

    Powered by Savane 3.6