1252417 - Graphite2 NULL pointer dereference in Slot::next

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Mateusz Jurczyk]

Attachment: Reproducers.

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36

Steps to reproduce:

The following crash due to a NULL pointer dereference can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility (git trunk), triggered with the following command:

$ ./gr2fonttest /path/to/file -auto

--- cut ---
==29716==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004f6234 bp 0x7ffc1e6be3f0 sp 0x7ffc1e6be3d0 T0)
    #0 0x4f6233 in graphite2::Slot::next() const graphite/src/./inc/Slot.h:85:33
    #1 0x5c7cd7 in graphite2::Segment::positionSlots(graphite2::Font const*, graphite2::Slot*, graphite2::Slot*, bool, bool) graphite/src/Segment.cpp:437:47
    #2 0x541803 in (anonymous namespace)::direct_run(bool, void* const*, unsigned char const*, int*, graphite2::Slot**&, unsigned char, graphite2::vm::Machine::status_t&, graphite2::SlotMap*) graphite/src/./inc/opcodes.h:408:9
    #3 0x547f4c in graphite2::vm::Machine::run(void* const*, unsigned char const*, graphite2::Slot**&) graphite/src/direct_machine.cpp:116:17
    #4 0x50a1ff in graphite2::vm::Machine::Code::run(graphite2::vm::Machine&, graphite2::Slot**&) const graphite/src/Code.cpp:745:13
    #5 0x5ab2d5 in graphite2::Pass::doAction(graphite2::vm::Machine::Code const*, graphite2::Slot*&, graphite2::vm::Machine&) const graphite/src/Pass.cpp:674:17
    #6 0x5a4e36 in graphite2::Pass::findNDoRule(graphite2::Slot*&, graphite2::vm::Machine&, graphite2::FiniteStateMachine&) const graphite/src/Pass.cpp:543:33
    #7 0x5a2bb9 in graphite2::Pass::runGraphite(graphite2::vm::Machine&, graphite2::FiniteStateMachine&, bool) const graphite/src/Pass.cpp:412:13
    #8 0x5d86ca in graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const graphite/src/Silf.cpp:423:21
    #9 0x54e14a in graphite2::Face::runGraphite(graphite2::Segment*, graphite2::Silf const*) const graphite/src/Face.cpp:180:16
    #10 0x57ca2f in graphite2::Segment::runGraphite() graphite/src/./inc/Segment.h:97:45
    #11 0x5796d3 in (anonymous namespace)::makeAndInitialize(graphite2::Font const*, graphite2::Face const*, unsigned int, graphite2::FeatureVal const*, gr_encform, void const*, unsigned long, int) graphite/src/gr_segment.cpp:46:67
    #12 0x579156 in gr_make_seg graphite/src/gr_segment.cpp:105:24
    #13 0x4ee2ea in Parameters::testFileFont() const (graphite/gr2fonttest/gr2fonttest+0x4ee2ea)
    #14 0x4f0387 in main (graphite/gr2fonttest/gr2fonttest+0x4f0387)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV graphite/src/./inc/Slot.h:85:33 in graphite2::Slot::next() const
==29716==ABORTING
--- cut ---

Attached is an archive with three font files which reproduce the crash.

Comment 1

[martin_hosken]

Fixed? in 80eeffe16258256012243b75ebfa45daed51a737

Comment 2

[Tyson Smith [:tsmith]]

Verified with graphite revision 520d76818052772d614e581dacea69499b912be6.

Mateusz can you please confirm? This will be marked fixed once the patches land in our branches.

Comment 3

[Mateusz Jurczyk]

I confirm that the crashes reported in this bug no longer reproduce with the latest revision.

Comment 4

[Daniel Veditz [:dveditz]]

Graphite2 has been updated on all affected branches including ESRs.