[Bug awt/38473] New: Segmentation fault in retrieving font outline decomposition

[gnu_andrew at member dot fsf dot org]

A segmentation fault occurs in FT_Outline_Decompose when called by
gnu_java_awt_peer_gtk_FreetypeGlyphVector.c.  It appears that the pointer to
the array of FT_Vectors representing the points is invalid.

This is from running valgrind on jamvm running the attached test case:

==31913== Thread 7:
==31913== Invalid read of size 8
==31913==    at 0x1312ACE6: FT_Outline_Decompose (ftoutln.c:91)
==31913==    by 0x11564A1A:
Java_gnu_java_awt_peer_gtk_FreetypeGlyphVector_getGlyphOutlineNative
(gnu_java_awt_peer_gtk_FreetypeGlyphVector.c:419)
==31913==    by 0x41EB4C: ??? (callNative.S:201)
==31913==    by 0x40B019: callJNIWrapper (dll.c:408)
==31913==    by 0x41E674: executeJava (interp.c:2267)
==31913==    by 0x40CA21: executeMethodVaList (execute.c:101)
==31913==    by 0x40CCC2: executeMethodArgs (execute.c:73)
==31913==    by 0x41866B: threadStart (thread.c:552)
==31913==    by 0x54CC06F: start_thread (pthread_create.c:297)
==31913==    by 0x57B294C: clone (in /lib64/libc-2.7.so)
==31913==  Address 0x500000006 is not stack'd, malloc'd or (recently) free'd

Debug output added to *FreetypeGlyphVector.c:

Get glyph for Helvetica
Calling FT_Outline_Decompose with outline 0xdaf4c20, callbacks 0x186afe20 and
path 0xdaf4b50
Outline: 1 contours (0xdaf4bb0), 0 points (0x500000006), 65537 flags
Contour 0 = 136

Any idea why the FT_Outline contains invalid data?

This occurs with JamVM and CACAO on current Classpath HEAD, and in gcj 4.3.3:

#0  FT_Outline_Decompose (outline=0x6ddbd8, func_interface=0x42dcca20,
user=0x6ddb70)
    at
/var/tmp/portage/media-libs/freetype-2.3.7/work/freetype-2.3.7/src/base/ftoutln.c:91
#1  0x00007f670b8a89de in
Java_gnu_java_awt_peer_gtk_FreetypeGlyphVector_getGlyphOutlineNative
(env=0x6bb1c0, 
    obj=<value optimized out>, glyphIndex=42, fnt=6961936)
    at
/var/tmp/portage/sys-devel/gcc-4.3.3/work/gcc-4.3.3/libjava/classpath/native/jni/gtk-peer/gnu_java_awt_peer_gtk_FreetypeGlyphVector.c:392
#2  0x00007f670f4048e2 in
gnu::java::awt::peer::gtk::FreetypeGlyphVector::getGlyphOutlineNative ()
   from /usr/lib/gcc/x86_64-pc-linux-gnu/4.3.3/libgcj.so.9
#3  0x00007f670f40565f in
gnu::java::awt::peer::gtk::FreetypeGlyphVector::getGlyphOutline ()
   from /usr/lib/gcc/x86_64-pc-linux-gnu/4.3.3/libgcj.so.9
#4  0x00007f670f405a67 in
gnu::java::awt::peer::gtk::FreetypeGlyphVector::getOutline ()
   from /usr/lib/gcc/x86_64-pc-linux-gnu/4.3.3/libgcj.so.9


-- 
           Summary: Segmentation fault in retrieving font outline
                    decomposition
           Product: classpath
           Version: unspecified
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: awt
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: gnu_andrew at member dot fsf dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38473