bugThe FreeType Project - Bugs: bug #26600, Operations with some Type 42 fonts...


You are not allowed to post comments on this tracker with your current authentication level.

bug #26600: Operations with some Type 42 fonts cause invalid free()

Submitted by:  Eugene A. Shatokhin <euspectre>
Submitted on:  Mon 18 May 2009 10:12:22 AM UTC  
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  2.3.10

Tue 19 May 2009 07:03:22 AM UTC, comment #1: 

Fixed in git.  Thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 18 May 2009 10:12:22 AM UTC, original submission:  

When working with a Type 42 font FreeMono.t42, invalid free() occurs in FT_Done_Face(). The attached example demonstrates this. This problem does not show up for some other Type 42 fonts.

FreeMono.t42 font was created using FontForge system (http://fontforge.sourceforge.net/) by converting FreeMono.ttf font (http://ftp.gnu.org/gnu/freefont/) to Type 42.

The issue described here shows up in Freetype 2.3.9 as well as
in Freetype2 version of 2009.04.30 (the latest one at the time of reporting), taken from the Freetype2 git-repository.

Executing the example program under Valgrind's MemCheck gives the following:

==10238== Invalid free() / delete / delete[]
==10238==    at 0x4C265AF: free (vg_replace_malloc.c:323)
==10238==    by 0x4E3903E: ft_free (ftsystem.c:158)
==10238==    by 0x4E45D6A: ft_mem_free (ftutil.c:171)
==10238==    by 0x4E7A4EF: T42_Face_Done (t42objs.c:407)
==10238==    by 0x4E3C27C: destroy_face (ftobjs.c:865)
==10238==    by 0x4E3E01F: FT_Done_Face (ftobjs.c:2227)
==10238==    by 0x4008C8: main (sample_t42.c:41)
==10238==  Address 0x5660000 is not stack'd, malloc'd or (recently) free'd

The failure in  t42objs.c file occurs when FT_FREE (info->version) is called.
Debugging the program showed that the fields of the structure info look reasonable except info->version. The latter field should contain a pointer to FT_String but actually it contains an invalid address value and that results in invalid free().

That is, perhaps there might be a problem in loading of the font rather than in T42_Face_Done() itself.

Executing ftview example for FreeMono.t42 font results in a crash for the same reason. Analysis carried out here using Valgrind gives the same data as listed above.

Eugene A. Shatokhin <euspectre>


Attached Files
file #18164:  sample-S0797.tgz added by euspectre (152KiB - application/x-gzip - The tarball contains a sample program and FreeMono.t42 font)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by euspectre (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-05-19 wl StatusNone => Fixed
        Assigned toNone => wl
        Open/ClosedOpen => Closed
        Planned ReleaseNone => 2.3.10
    2009-05-18 euspectre Attached File- => Added sample-S0797.tgz, #18164

    Back to the top

    Powered by Savane 3.7