bugThe FreeType Project - Bugs: bug #26600, Operations with some Type 42 fonts...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #26600: Operations with some Type 42 fonts cause invalid free()

Submitter:  Eugene A. Shatokhin <euspectre>
Submitted:  Mon 18 May 2009 10:12:22 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.3.10

Tue 19 May 2009 07:03:22 AM UTC, comment #1: 

Fixed in git.  Thanks for the report.

Werner LEMBERG <wl>
Group administrator
Mon 18 May 2009 10:12:22 AM UTC, original submission:  

When working with a Type 42 font FreeMono.t42, invalid free() occurs in FT_Done_Face(). The attached example demonstrates this. This problem does not show up for some other Type 42 fonts.

FreeMono.t42 font was created using FontForge system (http://fontforge.sourceforge.net/) by converting FreeMono.ttf font (http://ftp.gnu.org/gnu/freefont/) to Type 42.

The issue described here shows up in Freetype 2.3.9 as well as
in Freetype2 version of 2009.04.30 (the latest one at the time of reporting), taken from the Freetype2 git-repository.

Executing the example program under Valgrind's MemCheck gives the following:


==10238== Invalid free() / delete / delete[]
==10238==    at 0x4C265AF: free (vg_replace_malloc.c:323)
==10238==    by 0x4E3903E: ft_free (ftsystem.c:158)
==10238==    by 0x4E45D6A: ft_mem_free (ftutil.c:171)
==10238==    by 0x4E7A4EF: T42_Face_Done (t42objs.c:407)
==10238==    by 0x4E3C27C: destroy_face (ftobjs.c:865)
==10238==    by 0x4E3E01F: FT_Done_Face (ftobjs.c:2227)
==10238==    by 0x4008C8: main (sample_t42.c:41)
==10238==  Address 0x5660000 is not stack'd, malloc'd or (recently) free'd


The failure in  t42objs.c file occurs when FT_FREE (info->version) is called.
Debugging the program showed that the fields of the structure info look reasonable except info->version. The latter field should contain a pointer to FT_String but actually it contains an invalid address value and that results in invalid free().

That is, perhaps there might be a problem in loading of the font rather than in T42_Face_Done() itself.

Executing ftview example for FreeMono.t42 font results in a crash for the same reason. Analysis carried out here using Valgrind gives the same data as listed above.

Eugene A. Shatokhin <euspectre>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #18164:  sample-S0797.tgz added by euspectre (152KiB - application/x-gzip - The tarball contains a sample program and FreeMono.t42 font)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by euspectre (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-05-19 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.10
    2009-05-18 euspectre Attached File- Added sample-S0797.tgz, #18164

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code