<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEEDINFO "
title="NEEDINFO - evince abrt on a double free in cairo_truetype_font_destroy"
href="https://bugs.freedesktop.org/show_bug.cgi?id=102922#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEEDINFO "
title="NEEDINFO - evince abrt on a double free in cairo_truetype_font_destroy"
href="https://bugs.freedesktop.org/show_bug.cgi?id=102922">bug 102922</a>
from <span class="vcard"><a class="email" href="mailto:psychon@znc.in" title="Uli Schlachter <psychon@znc.in>"> <span class="fn">Uli Schlachter</span></a>
</span></b>
<pre><span class="quote">> ==7173== Invalid write of size 8
> ==7173== at 0x6C86FD7: cairo_truetype_font_write_glyf_table (cairo-truetype-subset.c:690)
> ==7173== by 0x6C8858B: cairo_truetype_font_generate (cairo-truetype-subset.c:978)
> ==7173== by 0x6C8858B: cairo_truetype_subset_init_internal (cairo-truetype-subset.c:1146)</span >
[...]
<span class="quote">> ==7173== Address 0x166d0558 is 8 bytes after a block of size 160 alloc'd
> ==7173== at 0x4C31B25: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==7173== by 0x6C87FAF: _cairo_truetype_font_create (cairo-truetype-subset.c:205)
> ==7173== by 0x6C87FAF: cairo_truetype_subset_init_internal (cairo-truetype-subset.c:1134)</span >
Line 690 is
<span class="quote">> font->glyphs[i].location = next - start_offset;</span >
The only statement modifying variable i is:
<span class="quote">> for (i = 0; i < font->base.num_glyphs; i++) {</span >
Since the above line is outside of this for-loop, i is at most
font->base.num_glyphs.
Looking a bit more at the callers, init_internal allocates the font with
_cairo_truetype_font_create(), which does:
<span class="quote">> font->glyphs = calloc (font->num_glyphs_in_face + 1, sizeof (subset_glyph_t));</span >
(I think) "num_glyphs_in_face" is (supposed to be) the number of glyphs in the
original font and "base.num_glyphs" is the number of glyphs which ended up in
the subsetted font. No idea why this manages to subset more glyphs than the
font even has. There are more numbers involved here
(cairo_truetype_subset_init_internal() uses
font->scaled_font_subset->num_glyphs...).
Behdad, ideas?
@Sebastian: You could try adding assert(font->base.num_glyphs <
font->num_glyphs_in_face); before the end of cairo_truetype_font_use_glyph().
This assert should trigger earlier than what valgrind can detect (ignore the
error which is only detected during free(), that's longer after things went
wrong). Hopefully the backtrace for this one would be more useful, but I am
just guessing here.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>