bugThe FreeType Project - Bugs: bug #30248, SIGSEGV - write to non-mapped...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30248: SIGSEGV - write to non-mapped memory (looks like it might be exploitable) in base/ftobjs.c:1563

Submitter:  Robert Swiecki <jagger>
Submitted:  Thu 24 Jun 2010 06:41:49 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  mpsuzuki Open/Closed:  Closed
Planned Release:  2.3.13

Jump to the original submission

Thu 01 Jul 2010 08:54:18 AM UTC, comment #8: 

I added additional buffer size checking
(at present, FreeType2 believes the
total size of PFB declared in header,
allocates the buffer by declared size,
and does not check overrun by putting
too long fragments). I close this issue.

suzuki toshiya <mpsuzuki>
Group administrator
Wed 30 Jun 2010 03:51:33 PM UTC, comment #7: 

Let's close this one, I've put description of this new issues in the bug #30306

Robert Swiecki <jagger>
Mon 28 Jun 2010 02:48:39 PM UTC, comment #6: 

I put another font here: http://alt.swiecki.net/j/f/sigabrt24.ttf

When using with MALLOC_CHECK_=3 it exits with SIGABRT, also valgrind shows some inconsistencies. Anyway, I understand that it might be hard to reproduce.


$ MALLOC_CHECK_=3 ./ftbench sigabrt24.ttf
* glibc detected * ./ftbench: free(): invalid pointer: 0x00000000006add00 *
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7ffff78b95b6]
./ftbench[0x47fdff]
./ftbench[0x410ab4]
./ftbench[0x40784d]
./ftbench[0x407b13]
./ftbench[0x407d86]
./ftbench[0x407fbe]
./ftbench[0x4083d4]
./ftbench[0x406e2c]
./ftbench[0x402b30]
./ftbench[0x402e9f]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ffff7860c4d]
./ftbench[0x401c79]
======= Memory map: ========
00400000-004a7000 r-xp 00000000 08:06 8995537                            /usr/local/google/fuzz/ttf/ftbench
006a6000-006a7000 r--p 000a6000 08:06 8995537                            /usr/local/google/fuzz/ttf/ftbench
006a7000-006a8000 rw-p 000a7000 08:06 8995537                            /usr/local/google/fuzz/ttf/ftbench
006a8000-006c9000 rw-p 00000000 00:00 0                                  [heap]
7ffff762b000-7ffff7641000 r-xp 00000000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7641000-7ffff7840000 ---p 00016000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7840000-7ffff7841000 r--p 00015000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7841000-7ffff7842000 rw-p 00016000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7842000-7ffff79bc000 r-xp 00000000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff79bc000-7ffff7bbb000 ---p 0017a000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bbb000-7ffff7bbf000 r--p 00179000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bbf000-7ffff7bc0000 rw-p 0017d000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bc0000-7ffff7bc5000 rw-p 00000000 00:00 0
7ffff7bc5000-7ffff7bdb000 r-xp 00000000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7bdb000-7ffff7dda000 ---p 00016000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7dda000-7ffff7ddb000 r--p 00015000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7ddb000-7ffff7ddc000 rw-p 00016000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0
7ffff7ff1000-7ffff7ff9000 r--p 00000000 08:06 8995860                    /usr/local/google/fuzz/ttf/sigabrt24.ttf
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted


$ MALLOC_CHECK_=3 gdb ./ftbench
(gdb) r -c 1 sigabrt24.ttf

Program received signal SIGABRT, Aborted.
0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff78795c0 in *__GI_abort () at abort.c:92
#2  0x00007ffff78af4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3  0x00007ffff78b95b6 in malloc_printerr (action=3, str=0x7ffff7989ab3 "free(): invalid pointer", ptr=<value optimized out>) at malloc.c:6264
#4  0x000000000047fdff in ft_free (memory=0x6a8010, block=0x6add00) at builds/unix/ftsystem.c:158
#5  0x0000000000410ab4 in ft_mem_free (memory=0x6a8010, P=0x6add00) at /usr/local/google/src/freetype2/src/base/ftutil.c:171
#6  0x000000000040784d in Mac_Read_POST_Resource (library=0x6a8040, stream=0x6adae0, offsets=0x6adc60, resource_cnt=17, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1598
#7  0x0000000000407b13 in IsMacResource (library=0x6a8040, stream=0x6adae0, resource_offset=128, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
#8  0x0000000000407d86 in IsMacBinary (library=0x6a8040, stream=0x6adae0, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
#9  0x0000000000407fbe in load_mac_face (library=0x6a8040, stream=0x6adae0, face_index=0, aface=0x7fffffffe520, args=0x7fffffffe400) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
#10 0x00000000004083d4 in FT_Open_Face (library=0x6a8040, args=0x7fffffffe400, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
#11 0x0000000000406e2c in FT_New_Face (library=0x6a8040, pathname=0x7fffffffe983 "sigabrt24.ttf", face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#12 0x0000000000402b30 in get_face (face=0x7fffffffe520) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#13 0x0000000000402e9f in main (argc=1, argv=0x7fffffffe650) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739



$ valgrind ./ftbench -c 1 sigabrt24.ttf
VALGRIND_MEMORY_LIMIT_IN_MB=4095; VALGRIND_TIMEOUT=3600
==6217== Memcheck, a memory error detector
==6217== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==6217== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==6217== Command: ./ftbench -c 1 sigabrt24.ttf
==6217==
==6217== Invalid write of size 1
==6217==    at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==  Address 0x53dd147 is 2 bytes after a block of size 30,069 alloc'd
==6217==    at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217==    by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217==    by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217==    by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217==    by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
==6217== Invalid write of size 1
==6217==    at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==  Address 0x53dd146 is 1 bytes after a block of size 30,069 alloc'd
==6217==    at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217==    by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217==    by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217==    by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217==    by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
==6217== Invalid write of size 1
==6217==    at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==  Address 0x53dd145 is 0 bytes after a block of size 30,069 alloc'd
==6217==    at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217==    by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217==    by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217==    by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217==    by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
couldn't load font resource
==6217==
==6217== HEAP SUMMARY:
==6217==     in use at exit: 0 bytes in 0 blocks
==6217==   total heap usage: 79 allocs, 79 frees, 82,656 bytes allocated
==6217==
==6217== All heap blocks were freed -- no leaks are possible
==6217==
==6217== For counts of detected and suppressed errors, rerun with: -v
==6217== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 4 from 0)

Robert Swiecki <jagger>
Fri 25 Jun 2010 02:16:07 PM UTC, comment #5: 

Looks good to me, thanks.

Robert Swiecki <jagger>
Fri 25 Jun 2010 02:03:30 AM UTC, comment #4: 

Because my patch can prevent visible SEGV (bug #30248)
and invisible heap corruption (bug #30249), I've committed
it to GIT head, as an initial fix for these 2 bugs.
Please check.

Of course, even if you can find the crashing problem is
fixed, I leave this bug as still open, because these fonts
are expected to be loaded correctly.

suzuki toshiya <mpsuzuki>
Group administrator
Fri 25 Jun 2010 12:35:27 AM UTC, comment #3: 

For first, thank you for reporting the issue.

Attached is a smallest fix to make FreeType2
stands with the font "sigsegv16.pfb". It just
checks the return value of FT_Stream_Read()
during the collection of the fragment of PFB
data splitted in Macintosh LaserWriter PS font.

By this patch, the font "sigsegv16.pfb" is
refused as broken, and no SEGV occurs.
Also, it is reasonable that the length, offset
red from the font file should be checked to
prevent a buffer overrun, I will insert more
value checks, to fix security issue.

However, Mac OS X accepts (the validation
of "FontBook.app" accepts) this font. Further
investigation is needed to provide expected
behaviour.

(file #20815)

suzuki toshiya <mpsuzuki>
Group administrator
Thu 24 Jun 2010 08:53:33 PM UTC, comment #2: 

There's a lot of code which is taking action on the basis of user's input, allocating memory, table indexes. This code must be rewritten, and all user-controlled values must be sanitized. It's definitely exploitable.

Robert Swiecki <jagger>
Thu 24 Jun 2010 07:01:05 PM UTC, comment #1: 

Some more info

when setting a watchpoint on pfb_pos

Hardware watchpoint 3: pfb_pos

Old value = 32727
New value = -7273265
Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1541
1541
    for ( i = 0; i < resource_cnt; ++i )
(gdb) p i
$75 = 16

(gdb) p rlen
$76 = -7305992

So the rlen variable is set to -7305992

And setting watchdog on rlen tells that it's being initialized with that negative value at

Hardware watchpoint 6: rlen

Old value = 2046
New value = -7305990
0x0000000000407d44 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1546
1546       if ( FT_READ_LONG( rlen ) )


Robert Swiecki <jagger>
Thu 24 Jun 2010 06:41:49 PM UTC, original submission:  

gcc version 4.4.3, compiled with "-O0 -g"

Font: http://alt.swiecki.net/j/f/sigsegv16.pfb

$ gdb ./ftbench

(gdb) r -c 1 sigsegv16.pfb

Program received signal SIGSEGV, Segmentation fault.
0x0000000000407df7 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
1563         pfb_data[pfb_pos++] = 0x80;

(gdb) x/x pfb_data[pfb_pos]
Cannot access memory at address 0x7ffff1b2b4df

(gdb) p pfb_pos
$1 = -7273265    <-- index is negative

(gdb) bt
#0  0x0000000000407df7 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
#1  0x000000000040822a in IsMacResource (library=0x6a9040, stream=0x6aea00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
#2  0x000000000040849d in IsMacBinary (library=0x6a9040, stream=0x6aea00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
#3  0x00000000004086d5 in load_mac_face (library=0x6a9040, stream=0x6aea00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
#4  0x0000000000408aed in FT_Open_Face (library=0x6a9040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
#5  0x0000000000407544 in FT_New_Face (library=0x6a9040, pathname=0x7fffffffe993 "sigsegv16.pfb", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#6  0x0000000000403240 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#7  0x00000000004035af in main (argc=1, argv=0x7fffffffe670) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739


$ valgrind ./ftbench -c 1 sigsegv16.pfb
==25059== Memcheck, a memory error detector
==25059== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==25059== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==25059== Command: ./ftbench -c 1 sigsegv16.pfb
==25059==
==25059==
==25059== Process terminating with default action of signal 11 (SIGSEGV)
==25059==  Bad permissions for mapped region at address 0x50D850F
==25059==    at 0x407DF7: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
==25059==    by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==25059==    by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==25059==    by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==25059==    by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==25059==    by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==25059==    by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==25059==    by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739


Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #20811:  sigsegv16.pfb added by jagger (45KiB - application/x-font-type1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mpsuzuki (Updated the item)
  • -email is unavailable- added by wl (Updated the item)
  • -email is unavailable- added by jagger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-07-01 mpsuzuki Open/ClosedOpen Closed
    2010-07-01 mpsuzuki StatusIn Progress Fixed
        Planned ReleaseNone 2.3.13
    2010-06-25 mpsuzuki StatusNone In Progress
    2010-06-25 mpsuzuki Attached File- Added fix-mac-read-post-resource_20100625a.patch, #20815
    2010-06-24 wl Assigned toNone mpsuzuki
    2010-06-24 jagger Attached File- Added sigsegv16.pfb, #20811

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code