After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 720379 - SIGFPE in pango_layout_iter_get_char_extents()
SIGFPE in pango_layout_iter_get_char_extents()
Status: RESOLVED FIXED
Product: pango
Classification: Platform
Component: general
1.34.x
Other Linux
: Normal normal
: ---
Assigned To: pango-maint
pango-maint
Depends on:
Blocks:
 
 
Reported: 2013-12-13 09:07 UTC by Akira TAGOH
Modified: 2013-12-15 23:43 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Akira TAGOH 2013-12-13 09:07:56 UTC
This issue was originally reported at Red Hat Bugzilla:
  https://bugzilla.redhat.com/show_bug.cgi?id=1036351

which GIMP crashed with SIGFPE at pango_layout_iter_get_char_extents at pango-layout.c:6098 in pango-1.34.1.
Comment 1 Matthias Clasen 2013-12-14 20:50:28 UTC
It would be fantastic to know the text that caused this
Comment 2 Behdad Esfahbod 2013-12-15 23:43:33 UTC
Pushed an untested fix out.  Would be nice to get it tested if the crash can be reproduced.

commit a6c318ee505aeabe6f84e1543d68834b9e0e7acf
Author: Behdad Esfahbod <behdad@behdad.org>
Date:   Sun Dec 15 18:42:17 2013 -0500

    Bug 720379 - SIGFPE in pango_layout_iter_get_char_extents()
    
    Untested.

diff --git a/pango/pango-layout.c b/pango/pango-layout.c
index a024d11..607a5f0 100644
--- a/pango/pango-layout.c
+++ b/pango/pango-layout.c
@@ -6178,8 +6178,15 @@ pango_layout_iter_get_char_extents (PangoLayoutIter *iter,
       return;
     }
 
-  x0 = (iter->character_position * cluster_rect.width) / iter->cluster_num_chars;
-  x1 = ((iter->character_position + 1) * cluster_rect.width) / iter->cluster_num_chars;
+  if (iter->cluster_num_chars)
+  {
+    x0 = (iter->character_position * cluster_rect.width) / iter->cluster_num_chars;
+    x1 = ((iter->character_position + 1) * cluster_rect.width) / iter->cluster_num_chars;
+  }
+  else
+  {
+    x0 = x1 = 0;
+  }
 
   logical_rect->width = x1 - x0;
   logical_rect->height = cluster_rect.height;