GNOME Bugzilla – Bug 621814
Crash in Lookup_MarkMarkPos()
Last modified: 2010-06-17 15:36:59 UTC
First of all, this bug has been reproduced in Pango 1.24.2 The affected OpenType code has already been removed from master, so if no one is maintaining this branch anymore please close this bug and excuse me for the annoyance. However if this is trivial to fix for anyone familiar with the code any help would be appreciated since systems shipping that Pango version would benefit for it. Now, to the point: We've made Pango crash in the N900. There's a test case here to reproduce the crash trivially: https://bugs.maemo.org/attachment.cgi?id=2890&action=view However it depends on the font you're using so I have only been able to make it crash in the N900. Here's the backtrace: Program received signal SIGSEGV, Segmentation fault. 0xb7258ee1 in Lookup_MarkMarkPos (gpi=0xbfc4e92c, st=0x9d73358, buffer=0x9d14620, flags=1024, context_length=65535, nesting_level=1) at harfbuzz-gpos.c:2993 2993 error = _HB_OPEN_Coverage_Index( &mmp->Mark2Coverage, IN_GLYPH( j ), (gdb) bt
+ Trace 222451
And here's the code: http://git.gnome.org/browse/pango/tree/pango/opentype/harfbuzz-gpos.c?id=f76a1696f903b90a192a626968dd0731e94b9c91#n2963 The thing here is that 'buffer->in_pos' is 1, so 'j' starts with 0, exits the while loop with 65535 (-1), and then IN_GLYPH(j) produces a segmentation fault. I'm not familiar with that code and I don't know if those values makes sense, but it appears to me that either the initial condition should be if ( buffer->in_pos <= 1 ) or there should be code checking/preventing the overflow of 'j' after the while loop. Changing the aforementioned condition seems to solve the problem, but then again I don't know this code so I'd appreciate any advice.
Something like: if (i > buffer->in_pos) return HB_Err_Not_Covered Should be added *after* the loop. There may be a couple similar loops elsewhere in that file, please check those. When you have a complete patch, may want to send it to distribution-list for others to use.
Created attachment 163902 [details] [review] Patch (In reply to comment #1) > Something like: > > if (i > buffer->in_pos) > return HB_Err_Not_Covered > > Should be added *after* the loop. Great, that solves the problem. All other loops seem correct. Thanks for your quick reply !
The reporter has also confirmed that the patch works fine: https://bugs.maemo.org/show_bug.cgi?id=10685#c10 I'll send it to distributor-list. If you think it's worth having in the 1.24 branch, please commit it. Thanks again!
I don't want to give people the idea false impression that 1.24 is actually maintained...