Bug 4674 - ft-font-create-for-ft-face works by pure chance
Summary: ft-font-create-for-ft-face works by pure chance
Status: RESOLVED FIXED
Alias: None
Product: cairo
Classification: Unclassified
Component: freetype font backend (show other bugs)
Version: 1.1.1
Hardware: x86 (IA32) Linux (All)
: high major
Assignee: Owen Taylor
QA Contact: cairo-bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-10-03 07:54 UTC by Christian Biesinger
Modified: 2006-01-20 15:11 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Christian Biesinger 2005-10-03 07:54:56 UTC
The thing is, this file does:
     53     font_face = cairo_ft_font_face_create_for_pattern (pattern);

With an empty pattern. However, cairo-ft-font.c does:
    391     if (FcPatternGetString (pattern, FC_FILE, 0, &fc_filename) !=
FcResultMatch)
    392         goto UNWIND;

and that code is hit; so that cairo_ft_font_face_create_for_pattern returns a
nil pattern:
   2170     unscaled = _cairo_ft_unscaled_font_create_for_pattern (pattern);
   2171     if (unscaled == NULL) {
   2172         _cairo_error (CAIRO_STATUS_NO_MEMORY);
   2173         return (cairo_font_face_t *)&_cairo_font_face_nil;

Bug #1: ft-font-create-for-ft-face doesn't check that create_for_pattern
returned a valid font face

This font face has the toy backend but is not a toy font face. It is a generic
font face.

(maybe) bug #2: the nil font face is not a toy face

But it goes on; ft-font-create-for-ft-face wants to create a scaled font. So it
calls cairo_scaled_font_create.

Bug #3: This function doesn't verify that face->status is OK.

It therefore goes on to create a scaled font using the default backend,
eventually leading to the FT backend trying to read ->family, which is random
memory.
Comment 1 Richard Lloyd 2005-10-17 08:09:32 UTC
Just a note that I'm seeing a core dump on the ft-font-create-for-ft-face "make
test" for cairo 1.0.2 on HP-UX 11.11 (PA-RISC) and 11.23 (PA-RISC and Itanium),
building with the latest stable cairo dependencies (e.g. freetype 2.1.10) and
gcc 4.0.2. I suspect it could be the same issue that Christian reported - the
same core dump also happens with cairo 1.0.0.
Comment 2 Carl Worth 2005-12-20 03:29:44 UTC
The following message (with patch) is also significant:

http://lists.freedesktop.org/archives/cairo/2005-December/005814.html

The mail archive doesn't semm entirely reliable, so I'll include the message
inline here as well.

-Carl

From: sunmoon1997 <sunmoon1997@gmail.com>
Subject: Re: [cairo] test ft-font-create-for-ft-face fails
To: Christian Biesinger <cbiesinger@web.de>
Cc: cairo@cairographics.org
Date: Thu, 08 Dec 2005 17:44:37 +0800
Sender: cairo-bounces@cairographics.org

ÔÚ 2005-12-07ÈýµÄ 21:04 -0800£¬Christian BiesingerдµÀ£º
> sunmoon1997 wrote:
> > hi,
> >   while running testsuit in cairo, the test ft-font-create-for-ft-face
> > failed with a pretty crash. After a quick look, the problem is
> > FcPatternAddString in fontconfig 2.4 branch doesn't accept null string
> > any more. The fix should be trivial, but I don't know the fix should go
> > cairo or fontconfig, so I attached both of them for review.
>
> Note https://bugs.freedesktop.org/show_bug.cgi?id=4674
>
For this bug:
- I think this test is not correct. A fresh empty pattern is
*meaningless*, you should pass it to fontconfig as input pattern to
match a font, then fontconfig will return a resolved pattern. You can
use this pattern whatever you want.
- cairo_scaled_font_create should check font_face->status.

Index: src/cairo-scaled-font.c
===================================================================
RCS file: /cvs/cairo/cairo/src/cairo-scaled-font.c,v
retrieving revision 1.8
diff -u -p -r1.8 cairo-scaled-font.c
--- src/cairo-scaled-font.c     9 Nov 2005 01:16:21 -0000       1.8
+++ src/cairo-scaled-font.c     8 Dec 2005 09:32:33 -0000
@@ -405,6 +405,9 @@ cairo_scaled_font_create (cairo_font_fac
     cairo_scaled_font_map_t *font_map;
     cairo_scaled_font_t key, *scaled_font = NULL;

+    if (font_face->status)
+       return (cairo_scaled_font_t *)&_cairo_scaled_font_nil;
+
     font_map = _cairo_scaled_font_map_lock ();
     if (font_map == NULL)
        goto UNWIND;
Index: test/ft-font-create-for-ft-face.c
===================================================================
RCS file: /cvs/cairo/cairo/test/ft-font-create-for-ft-face.c,v
retrieving revision 1.1
diff -u -p -r1.1 ft-font-create-for-ft-face.c
--- test/ft-font-create-for-ft-face.c   17 Aug 2005 16:51:09 -0000      1.1
+++ test/ft-font-create-for-ft-face.c   8 Dec 2005 09:32:34 -0000
@@ -35,7 +35,8 @@ cairo_test_t test = {
 static cairo_test_status_t
 draw (cairo_t *cr, int width, int height)
 {
-    FcPattern *pattern;
+    FcPattern *pattern, *resolved;
+    FcResult  result;
     cairo_font_face_t *font_face;
     cairo_scaled_font_t *scaled_font;
     cairo_font_options_t *font_options;
@@ -50,7 +51,14 @@ draw (cairo_t *cr, int width, int height
     if (!pattern)
        return CAIRO_TEST_FAILURE;

-    font_face = cairo_ft_font_face_create_for_pattern (pattern);
+    FcConfigSubstitute (NULL, pattern, FcMatchPattern);
+    FcDefaultSubstitute (pattern);
+    resolved = FcFontMatch (NULL, pattern, &result);
+
+    if (!resolved)
+       return CAIRO_TEST_FAILURE;
+
+    font_face = cairo_ft_font_face_create_for_pattern (resolved);

     cairo_matrix_init_identity (&font_matrix);

@@ -68,6 +76,7 @@ draw (cairo_t *cr, int width, int height
     cairo_font_options_destroy (font_options);
     cairo_font_face_destroy (font_face);
     FcPatternDestroy (pattern);
+    FcPatternDestroy (resolved);

     if (!ft_face) {
        cairo_scaled_font_destroy (scaled_font);

_______________________________________________
cairo mailing list
cairo@cairographics.org
http://cairographics.org/cgi-bin/mailman/listinfo/cairo


Comment 3 Carl Worth 2006-01-21 10:11:49 UTC
This is now fixed in CVS (1.1.1)

2006-01-20  Carl Worth  <cworth@cworth.org>

        * test/ft-font-create-for-ft-face.c: (draw): Fix test to use
        fontconfig properly so that the test no longer fails. Fixes bug
        #4674. (Thanks to sunmoon1997 for the fix).

-Carl


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.