patchThe FreeType Project - Patches: patch #7952, crash in sfnt/sfobjs.c:166 with...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #7952: crash in sfnt/sfobjs.c:166 with xpdf 3.03 and embedded fonts

Submitter:  Rainer Canavan <canavan>
Submitted:  Sun 17 Feb 2013 04:57:11 PM UTC
   
 
Category:  None Priority:  5 - Normal
Status:  Invalid Privacy:  Public
Assigned to:  wl Open/Closed:  Closed

Wed 20 Feb 2013 08:22:48 AM UTC, comment #3: 

Closed, thanks.

Werner LEMBERG <wl>
Group administrator
Tue 19 Feb 2013 11:52:10 PM UTC, comment #2: 

You are correct, this does not make sense. It turns out to be a compiler optimization problem that disappears at -O2 or less.

For the sake of completeness, ftview segfaults as well, the fonts in the PDF that cause segfaults in that PDF are CANEPP+Arial-0259.ttf, CANEMM+MSMincho-0257.ttf and CANJKP+a__APC-0269.ttf

Rainer Canavan <canavan>
Mon 18 Feb 2013 06:47:52 AM UTC, comment #1: 

Thanks for the report.  However, the patch makes no sense.  `face' gets already accessed in the function one level higher, so it certainly is non-NULL.

Which font in the PDF actually causes the problem?  Can you repeat the problem with an ftdemo program like ftview?

Werner LEMBERG <wl>
Group administrator
Sun 17 Feb 2013 04:57:11 PM UTC, original submission:  

Some .PDFs crash xdf 3.03 on IRIX in freetype's src/sfnt/sfobjs.c":166.

An example PDF would be here: http://www.apcmedia.com/salestools/ASTE-6Z6KAM_R0_EN.pdf

The trivial attached patch fixes this issue. All backtrace of xpdf crashing look basically like this:


>  0 tt_face_get_name(0x1042a370, 0x15, 0x1042a384, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/sfnt/sfobjs.c":166, 0x462494]

   1 sfnt_load_face(0x4623c0, 0x1042a370, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/sfnt/sfobjs.c":783, 0x4632f8]
   2 tt_face_init(0x0, 0x0, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/truetype/ttobjs.c":557, 0x426db4]
   3 open_face(0x0, 0x0, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/base/ftobjs.c":1236, 0x40d448]
   4 FT_Open_Face(0x1042a370, 0x7ffb6720, 0x0, 0x0, 0x102ad8e0, 0x0, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/base/ftobjs.c":2166, 0x40ec94]
   5 FT_New_Face(0x1042a370, 0x102ae314, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/freetype/freetype-2.4.11/src/base/ftobjs.c":1298, 0x40d544]
   6 SplashFTFontFile::loadTrueTypeFont(SplashFTFontEngine*,SplashFontFileID*,char*,int,int,int*,int)(0x4, 0x0, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/splash/SplashFTFontEngine.cc":75, 0x100fe174]
   7 SplashFTFontEngine::loadTrueTypeFont(SplashFontFileID*,char*,int,int,int*,int)(0x0, 0x0, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/splash/SplashFontEngine.cc":174, 0x10102cf4]   8 SplashFontEngine::loadTrueTypeFont(SplashFontFileID*,char*,int,int,int*,int,char*)(0x1042a370, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/splash/SplashFontEngine.cc":262, 0x101066ac]   9 SplashOutputDev::doUpdateFont(GfxState*)(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1046d220, 0x0) ["/usr/people/canavan/src/xpdf/xpdf-3.03/splash/SplashFontEngine.cc":1319, 0x10109d50]
   10 SplashOutputDev::drawChar(GfxState*,double,double,double,double,double,double,unsigned int,int,unsigned int*,int)(0x1028ceb0, 0x10479100, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/splash/SplashFontEngine.cc":1678, 0x1010a518]
   11 Gfx::doShowText(GString*)(0x1046a1b8, 0x10429b18, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/goo/gmem.cc":3480, 0x1017d4d4]
   12 Gfx::opShowSpaceText(Object*,int)(0x1046a1b8, 0x0, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/goo/gmem.cc":3315, 0x1017cac4]
   13 Gfx::go(int)(0x0, 0x0, 0x1, 0xffff, 0x101de6f0, 0x0, 0x2, 0x0) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/CMap.cc":729, 0x10051bdc]
More (n if no)?
   14 Gfx::display(Object*,int)(0x1046a1b8, 0x7ffb71d0, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/goo/gmem.cc":587, 0x1017c5b8]
   15 Page::displaySlice(OutputDev*,double,double,int,int,int,int,int,int,int,int,int ()(void),void*)(0x102aecd0, 0x1028ceb0, 0x102aecd0, 0x1046a1b8, 0x1046a1b8, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/SplashOutputDev.cc":350, 0x1012f1f8]
   16 PDFDoc::displayPageSlice(OutputDev*,int,double,double,int,int,int,int,int,int,int,int,int ()(void),void*)(0x1042a370, 0x15, 0x0, 0xffff, 0x0, 0x0, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/Link.cc":410, 0x100aca34]
   17 PDFCore::update(int,int,int,double,int,int,int,int)(0x1028c858, 0x102cd3a8, 0x0, 0x3de, 0x8000, 0x3de, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/Link.cc":884, 0x100afde8]   18 XPDFCore::update(int,int,int,double,int,int,int,int)(0x1028c858, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/Link.cc":284, 0x100b06b0]   19 PDFCore::gotoNextPage(int,int)(0x1042a370, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/Link.cc":926, 0x100ab288]
   20 XPDFCore::gotoNextPage(int,int)(0x0, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/Link.cc":312, 0x100ab31c]
   21 XPDFViewer::nextPageCbk(_WidgetRec*,void*,void*)(0x1042a370, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/XPDFApp.cc":2589, 0x100984b4]   22 XtCallCallbackList(0x1027d158, 0x1027acc8, 0x7ffb75e0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/Intrinsic.c":671, 0xf429040]
   23 ActivateCommon(0x1027d158, 0x7ffb7838, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/motif2.1/src/lib/Xm/PushB.c":2433, 0x41a1044]
   24 Activate(0x1042a370, 0x15, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/motif2.1/src/lib/Xm/PushB.c":2342, 0x41a10f4]
   25 HandleActions(0x1027d158, 0x7ffb7838, 0x0, 0x1027d158, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/VarCreate.c":627, 0xf47c8fc]
   26 HandleComplexState(0x0, 0x1027d188, 0x7ffb7700, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/VarCreate.c":1053, 0xf4901a4]
   27 _XtTranslateEvent(0x1042a370, 0x7ffb7838, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/Intrinsic.c":1085, 0xf427854]
   28 XtDispatchEventToWidget(0x1027d158, 0x7ffb7838, 0x0, 0xffff, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/EventUtil.c":1033, 0xf42625c]
More (n if no)?
   29 _XtDefaultDispatcher(0x7ffb7838, 0x15, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/EventUtil.c":1507, 0xf47a200]
   30 XtAppMainLoop(0x10221a10, 0x15, 0x0, 0x0, 0x8000, 0x10000, 0x2, 0x1) ["/xlv41/6.5.30m/work/x/xc/lib/Xt/EventUtil.c":1570, 0xf4248cc]
   31 ::main(0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x1) ["/usr/people/canavan/src/xpdf/xpdf-3.03/xpdf/GlobalParams.cc":313, 0x100503ec]
   32 __start() ["/xlv55/kudzu-apr12/work/irix/lib/libc/libc_n32_M4/csu/crt1text.s":177, 0x10030fe8]


Rainer Canavan <canavan>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #27479:  neko_freetype.patch added by canavan (562B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by canavan (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-02-20 wl StatusNeed Info Invalid
        Open/ClosedOpen Closed
    2013-02-18 wl StatusNone Need Info
        Assigned toNone wl
    2013-02-17 canavan Attached File- Added neko_freetype.patch, #27479

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code