bugThe FreeType Project - Bugs: bug #23204, freetype2 crashes

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23204: freetype2 crashes

Submitter:  None
Submitted:  Thu 08 May 2008 01:09:14 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  mpsuzuki Open/Closed:  Closed
Planned Release:  2.3.6

Thu 22 May 2008 03:09:54 AM UTC, comment #2: 

Just I've checked that ftmac.c functionalities on x86_64.
The reported bug is reproduced by fontconfig & freetype
bundled to Mac OS X 10.5. The bundled freetype seems to be
freetype-2.3.5 which is released before Mac OS X 10.5,
thus, it was not ready for Mac OS X 10.5.

Genuine Suitcase font does not make freetype-2.3.5 crashed,
but any ".dfont" files make it crashed. freetype-2.3.5 with
proposed patch does not crash, but still it cannot load any
".dfont" files.

The latest FreeType2 on CVS is already fixed for Mac OS X
10.5, and it can load all ".dfont" in Mac OS X 10.5 even
without the proposed patch. Thus, the complete solution of
the problem is that Apple updates freetype-2.3.5 by latest
one.

Anyway, "*aface" is still a pointer to another pointer
(typed FT_FaceRec*), so checking "*aface != NULL" is not
bad idea. I leave proposed patch as applied, although it
is not required anymore.

suzuki toshiya <mpsuzuki>
Group administrator
Tue 20 May 2008 08:04:27 AM UTC, comment #1: 

Thank you for hunting a bug in ftmac.c and the patch to fix it.
The patch looks good and I applied it on CVS.

I think the initialized-but-unfinished aface is returned by
FT_New_Face_From_FOND(), so the proposed patch is not terminal
fix. I have to track more detail of the origin of the bug.

The crash on x86_64 arch is now fixed, but the functionality
of ftmac.c on x86_64 arch is still questionable. As soon as
I can access x86_64 Macintosh, I will improve
FT_New_Face_From_FOND() not to return invalid aface.
Thus I leave this bug for a while (within a few weeks),
please wait.

suzuki toshiya <mpsuzuki>
Group administrator
Thu 08 May 2008 01:09:14 PM UTC, original submission:  
  • SUMMARY

When using the inbuilt freetype2 through fontconfig, a program will crash when linked and run against 64-bit Intel Leopard.

  • STEPS TO REPRODUCE

1. Compile the enclosed program as follows:
gcc -I/usr/X11/include -L/usr/X11/lib -lfontconfig -o testfontconfig -arch x86_64 testfontconfig.c
2. Remove any user font cache:
rm -rf ~/.fontconfig
3. Run the program.
./testfontconfig

  • RESULTS

It crashes with a Segmentation Fault.

  • REGRESSION

If you use -arch i386, -arch ppc or -arch ppc64, the problem does not occur.

  • NOTES

Running this in gdb produces the following backtrace:

#0  0x0000000100053783 in FT_New_Face_From_Suitcase ()
#1  0x00000001000539c2 in FT_New_Face_From_Resource ()
#2  0x0000000100053a39 in FT_New_Face ()
#3  0x000000010000f753 in FcFreeTypeQuery ()
#4  0x000000010000e652 in FcFileScanFontConfig ()
#5  0x000000010000e7a5 in FcFileScanConfig ()
#6  0x000000010000eaa7 in FcDirCacheScan ()
#7  0x000000010000eb82 in FcDirCacheRead ()
#8  0x00000001000071fb in FcConfigAddDirList ()
#9  0x00000001000072b9 in FcConfigBuildFonts ()
#10 0x0000000100013344 in FcInitLoadConfigAndFonts ()
#11 0x000000010001338e in FcInit ()
#12 0x0000000100000f8f in main ()

FT_New_Face_From_Suitcase appears to crash because of a write to a null pointer because it can't find any FOND resources in the file and the code assumes at least one is found. The enclosed patch ftmac.c.patch fixes the immediate problem (preventing the crash because of a null pointer), but doesn't address the underlying cause.


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #15641:  freetype.patch added by None (455B)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mpsuzuki (Posted a comment)
  • -email is unavailable- added by wl (Updated the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-09-15 wl StatusNone Fixed
    2008-05-22 mpsuzuki Open/ClosedOpen Closed
    2008-05-20 mpsuzuki Planned ReleaseNone 2.3.6
    2008-05-08 wl Assigned toNone mpsuzuki
    2008-05-08 None Attached File- Added testfontconfig.c, #15640
        Attached File- Added freetype.patch, #15641

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code