Bug 420916 – scim-helper-launcher crashed with SIGSEGV in pango_fc_font_real_get_glyph()

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 420916 - scim-helper-launcher crashed with SIGSEGV in pango_fc_font_real_get_glyph()


Summary:	scim-helper-launcher crashed with SIGSEGV in pango_fc_font_real_get_glyph()


Status:	RESOLVED FIXED

Product:	pango
Classification:	Platform
Component:	hangul
Version:	1.16.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Changwoo Ryu
QA Contact:	pango-maint

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2007-03-21 09:32 UTC by Sebastien Bacher
Modified:	2007-09-07 19:20 UTC

See Also:
GNOME target:	---
GNOME version:	2.17/2.18

Attachments
Missing g_return_val_if_fail(PANGO_IS_FC_FONT()) on public function (478 bytes, patch) 2007-03-21 09:52 UTC, Chris Wilson	rejected	Details \| Review
Throw a g_error instead of warning+exit (532 bytes, patch) 2007-03-21 09:53 UTC, Chris Wilson	committed	Details \| Review

Description Sebastien Bacher 2007-03-21 09:32:54 UTC

The bug has been opened on https://launchpad.net/bugs/94328

"Binary package hint: scim

i am sorry about information this bug. after feisty upgrading by internet downloading

i logged in kde session succesflly

ProblemType: Crash
Architecture: i386
Date: Tue Mar 20 00:53:37 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/lib/scim-1.0/scim-helper-launcher
Package: scim 1.4.4-7ubuntu1
PackageArchitecture: i386
...
libpango1.0-0 1.16.1-0ubuntu1
...
.

+ Trace 120685

Thread 1 (process 8891)

#0 pango_fc_font_real_get_glyph
at /build/buildd/pango1.0-1.16.1/./pango/pangofc-font.c line 564
#1 pango_fc_font_get_glyph
at /build/buildd/pango1.0-1.16.1/./pango/pangofc-font.c line 671
#2 render_basic
at /build/buildd/pango1.0-1.16.1/./modules/hangul/hangul-fc.c line 389
#3 hangul_engine_shape
at /build/buildd/pango1.0-1.16.1/./modules/hangul/hangul-fc.c line 429
#4 _pango_engine_shape_shape
at /build/buildd/pango1.0-1.16.1/./pango/pango-engine.c line 71
#5 pango_shape
at /build/buildd/pango1.0-1.16.1/./pango/shape.c line 51
#6 shape_run
at /build/buildd/pango1.0-1.16.1/./pango/pango-layout.c line 3020
#7 process_item
at /build/buildd/pango1.0-1.16.1/./pango/pango-layout.c line 3112
#8 pango_layout_check_lines
at /build/buildd/pango1.0-1.16.1/./pango/pango-layout.c line 3349
#9 pango_layout_get_extents_internal
at /build/buildd/pango1.0-1.16.1/./pango/pango-layout.c line 2318
#10 gtk_label_size_request
at gtklabel.c line 2117
#11 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#12 g_type_class_meta_marshal
at gclosure.c line 567
#13 IA__g_closure_invoke
at gclosure.c line 490
#14 signal_emit_unlocked_R
at gsignal.c line 2370
#15 IA__g_signal_emit_valist
at gsignal.c line 2199
#16 IA__g_signal_emit_by_name
at gsignal.c line 2267
#17 do_size_request
at gtksizegroup.c line 592
#18 _gtk_size_group_compute_requisition
at gtksizegroup.c line 792
#19 IA__gtk_widget_size_request
at gtkwidget.c line 2880
#20 gtk_vbox_size_request
at gtkvbox.c line 95
#21 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#22 g_type_class_meta_marshal
at gclosure.c line 567
#23 IA__g_closure_invoke
at gclosure.c line 490
#24 signal_emit_unlocked_R
at gsignal.c line 2370
#25 IA__g_signal_emit_valist
at gsignal.c line 2199
#26 IA__g_signal_emit_by_name
at gsignal.c line 2267
#27 do_size_request
at gtksizegroup.c line 592
#28 _gtk_size_group_compute_requisition
at gtksizegroup.c line 792
#29 IA__gtk_widget_size_request
at gtkwidget.c line 2880
#30 SetupUI::create_splash_view
at scim_setup_ui.cpp line 374
#31 SetupUI::create_module_list_model
at scim_setup_ui.cpp line 422
#32 SetupUI
at scim_setup_ui.cpp line 95
#33 setup_LTX_scim_helper_module_run_helper
at scim_setup_helper.cpp line 84
#34 scim::HelperModule::run_helper
at scim_helper_module.cpp line 123
#35 main
at scim_helper_launcher.cpp line 169
#36 __libc_start_main
from /lib/tls/i686/cmov/libc.so.6
#37 _start

Comment 1 Sebastien Bacher 2007-03-21 09:34:44 UTC

corresponding source line: "      if (index > (FT_UInt)face->num_glyphs)"

Comment 2 Chris Wilson 2007-03-21 09:51:13 UTC

Hmm, face can only be NULL at that point iff !PANGO_IS_FC_FONT(font) or else the lock face would have called exit() instead of returning an error.

Comment 3 Chris Wilson 2007-03-21 09:52:31 UTC

Created attachment 85022 [details] [review]
Missing g_return_val_if_fail(PANGO_IS_FC_FONT()) on public function

Comment 4 Chris Wilson 2007-03-21 09:53:56 UTC

Created attachment 85023 [details] [review]
Throw a g_error instead of warning+exit

Comment 5 Chris Wilson 2007-03-21 10:03:06 UTC

However I can not see how a non-PangoFcFont could have been utilized along that path...

Sebastien, could you ask the original reporter to run the crash through valgrind? Thanks.

Comment 6 Sebastien Bacher 2007-03-21 10:09:22 UTC

I've added a comment to the launchpad bug about the valgrind log

Comment 7 Changwoo Ryu 2007-03-26 00:08:44 UTC

Hmm if it's really a non-PangoFcFont, pango_fc_font_real_get_glyph() should not be called...

Comment 8 Sebastien Bacher 2007-04-16 21:32:20 UTC

closing for now, I'll reopen if the submitter reply

Comment 9 Sebastien Bacher 2007-04-16 21:33:51 UTC

letting the upstream bug open rather, there is patches attached there

Comment 10 Behdad Esfahbod 2007-09-07 19:19:12 UTC

2007-09-07  Behdad Esfahbod  <behdad@gnome.org>

        Patch from Chris Wilson

        * pango/pangoft2.c (load_fallback_face): Use g_error() instead
        of g_warning()+exit().

Comment 11 Behdad Esfahbod 2007-09-07 19:20:28 UTC

I fixed this a while ago:

2007-08-14  Behdad Esfahbod  <behdad@gnome.org>

        Bug 466755 – pango hangul is crashing in gnome-about because it is
        failing to retrieve a font.

        * pango/pangofc-font.c (pango_fc_font_real_get_glyph),
        (pango_fc_font_kern_glyphs), (pango_fc_font_get_raw_extents):
        Protect against NULL face.