Debian Bug report logs - #372719
Freetype and OpenOffice

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Eric Frankenberg <eric.frankenberg@iut-tlse3.fr>

To: submit@bugs.debian.org

Subject: Freetype and OpenOffice

Date: Sun, 11 Jun 2006 12:00:23 +0200

Package: libfreetype6
Version: 2.1.7-2.5

I'm using debian sarge.
I upgraded libfreetype6 yesterday (2006/06/10).

After that, OpenOffice 2.02 (installed from www.openoffice.org) crashed 
when I saved a file.

I downgraded to 2.1.7-2.4 and now everything works perfectly.

Message #10 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Bob Hauck <bobh@haucks.org>

To: 372719@bugs.debian.org

Subject: Freetype and OpenOffice

Date: Sun, 11 Jun 2006 11:50:03 -0400

I have the exact same problem here.  Downgrading also fixes it for me.

OpenOffice writer appears to finish saving, the progress bar goes all 
the way, but then I get the watch cursor and after a while I get the 
OpenOffice crash dialog and my file has not been saved.


-- 
 -| Bob Hauck
 -| A proud member of the unhinged moonbat horde.
 -| http://www.haucks.org/

Message #15 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Jérôme Bertorelle <jerome@sequans.com>

To: Debian Bug Tracking System <372719@bugs.debian.org>

Subject: libfreetype6: Stack trace with OOo 2.02

Date: Tue, 13 Jun 2006 19:36:17 +0200

Package: libfreetype6
Version: 2.1.7-2.4
Followup-For: Bug #372719


Same issue here: version 2.1.7-2.5 makes OOo 2.02 (from www.openoffice.o
rg,
installed through alien) crash, while everything is ok with the version
2.1.7-2.4 I reverted to.

The crash occurs when saving a file. Bob's problem is probably related
to the autosave feature (try to automatically save after a while, and 
triggers the bug).

The bug is not systematic, for very small document saving may succeed. B
ut
it's very frequent and systematic with complex documents. If you need so
me
document to reproduce the bug please contact me privately.

The crash is due to a SIGFPE in libfreetype6, here's a gdb trace:

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 1099903904 (LWP 31680)]
0x413a2a84 in ps_hints_apply () from /usr/lib/libfreetype.so.6
(gdb) where
#0  0x413a2a84 in ps_hints_apply () from /usr/lib/libfreetype.so.6
#1  0x4137bd2a in FT_Render_Glyph_Internal () from /usr/lib/libfreetype.
so.6
#2  0x4137d446 in FT_Glyph_To_Bitmap () from /usr/lib/libfreetype.so.6
#3  0x40289b86 in ServerFontLayout::LayoutText ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#4  0x42523ae3 in X11SalInstance::CreateInfoPrinter ()
  from /opt/openoffice.org2.0/program/libvclplug_gen680li.so
#5  0x4251a1cd in X11SalGraphics::DrawServerSimpleFontString ()
  from /opt/openoffice.org2.0/program/libvclplug_gen680li.so
#6  0x4251a316 in X11SalGraphics::DrawServerFontLayout ()
  from /opt/openoffice.org2.0/program/libvclplug_gen680li.so
#7  0x40285ed6 in ServerFontLayout::DrawText ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#8  0x40124799 in OutputDevice::DrawTextLine ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#9  0x40124f3d in OutputDevice::DrawTextLine ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#10 0x40125e22 in OutputDevice::DrawTextArray ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#11 0x400fa1bf in MetaTextArrayAction::Execute ()
  from /opt/openoffice.org2.0/program/libvcl680li.so
#12 0x400d266c in GDIMetaFile::Play () from /opt/openoffice.org2.0/progr
am/libvcl680li.so
#13 0x400d2888 in GDIMetaFile::Play () from /opt/openoffice.org2.0/progr
am/libvcl680li.so
#14 0x457de175 in SfxObjectShell::GetDocumentPrinter ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#15 0x457deca7 in SfxObjectShell::GetDocumentPrinter ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#16 0x45777f99 in SfxObjectShell::WriteThumbnail ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#17 0x457780f8 in SfxObjectShell::GenerateAndStoreThumbnail ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#18 0x4577e83c in SfxObjectShell::DoLoad ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#19 0x457809d7 in SfxObjectShell::DoLoad ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#20 0x45780d70 in SfxObjectShell::DoSaveAs ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#21 0x457c3e3d in SfxBaseModel::storeSelf ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#22 0x457da1b6 in non-virtual thunk to SfxBaseModel::dispose() ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#23 0x457887ea in SfxObjectShell::GetDocumentSignatureState ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#24 0x4578ab84 in SfxObjectShell::SignDocumentContent ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#25 0x4582ffe7 in SfxDispatcher::GetDisableFlags ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#26 0x4583031c in SfxDispatcher::_Execute ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
#27 0x458303bc in SfxDispatcher::_Execute ()
  from /opt/openoffice.org2.0/program/libsfx680li.so
[cut here...]

Jerome

-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.8-3-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages libfreetype6 depends on:
ii  libc6                 2.3.2.ds1-22sarge3 GNU C Library: Shared libra
ries an
ii  zlib1g                1:1.2.2-4.sarge.2  compression library - runti
me

-- no debconf information

Message #24 received at 372719-submitter@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Jérôme Bertorelle <jerome@sequans.com>, 372719-submitter@bugs.debian.org

Subject: Re: Bug#372719: libfreetype6: Stack trace with OOo 2.02

Date: Wed, 14 Jun 2006 20:51:14 -0700

[Message part 1 (text/plain, inline)]

Hi Jérome,

On Tue, Jun 13, 2006 at 07:36:17PM +0200, Jérôme Bertorelle wrote:
> The crash is due to a SIGFPE in libfreetype6, here's a gdb trace:

> Program received signal SIGFPE, Arithmetic exception.
> [Switching to Thread 1099903904 (LWP 31680)]
> 0x413a2a84 in ps_hints_apply () from /usr/lib/libfreetype.so.6
> (gdb) where
> #0  0x413a2a84 in ps_hints_apply () from /usr/lib/libfreetype.so.6
> #1  0x4137bd2a in FT_Render_Glyph_Internal () from /usr/lib/libfreetype.
> so.6
> #2  0x4137d446 in FT_Glyph_To_Bitmap () from /usr/lib/libfreetype.so.6

<snip>

Please try the package at
http://people.debian.org/~vorlon/libfreetype6_2.1.7-3_i386.deb and let me
know if this fixes the problems you're seeing.

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

[signature.asc (application/pgp-signature, inline)]

Message #27 received at 372719-submitter@bugs.debian.org (full text, mbox, reply):

From: Jérôme Bertorelle <jerome@sequans.com>

To: Steve Langasek <vorlon@debian.org>

Cc: 372719-submitter@bugs.debian.org

Subject: Re: Bug#372719: libfreetype6: Stack trace with OOo 2.02

Date: Thu, 15 Jun 2006 09:58:51 +0200

Steve Langasek wrote:
> Hi Jérome,
>
> On Tue, Jun 13, 2006 at 07:36:17PM +0200, Jérôme Bertorelle wrote:
>   
>> The crash is due to a SIGFPE in libfreetype6, here's a gdb trace:
>>     
> [...]
>   
> Please try the package at
> http://people.debian.org/~vorlon/libfreetype6_2.1.7-3_i386.deb and let
 me
> know if this fixes the problems you're seeing.
>   
Yes, this fixes the problems. Thanks!

Jérôme

Message #30 received at 372719-submitter@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Jérôme Bertorelle <jerome@sequans.com>

Cc: 372719-submitter@bugs.debian.org

Subject: Re: Bug#372719: libfreetype6: Stack trace with OOo 2.02

Date: Thu, 15 Jun 2006 01:40:22 -0700

[Message part 1 (text/plain, inline)]

On Thu, Jun 15, 2006 at 09:58:51AM +0200, Jérôme Bertorelle wrote:
> Steve Langasek wrote:
> >Hi Jérome,

> >On Tue, Jun 13, 2006 at 07:36:17PM +0200, Jérôme Bertorelle wrote:

> >>The crash is due to a SIGFPE in libfreetype6, here's a gdb trace:

> >[...]

> >Please try the package at
> >http://people.debian.org/~vorlon/libfreetype6_2.1.7-3_i386.deb and let
>  me
> >know if this fixes the problems you're seeing.

> Yes, this fixes the problems. Thanks!

Great, I'll send this over to the security team for an updated DSA.

Cheers,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

[signature.asc (application/pgp-signature, inline)]

Message #37 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Filipus Klutiero <ido@vif.com>

To: rene@debian.org

Cc: 372719@bugs.debian.org

Subject: Etch?

Date: Sun, 18 Jun 2006 21:25:00 -0400

Rene, what evidence is there that this bug affects Etch?

Message #46 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Rene Engelhard <rene@debian.org>

To: Filipus Klutiero <ido@vif.com>

Cc: 372719@bugs.debian.org

Subject: Re: Etch?

Date: Mon, 19 Jun 2006 04:34:52 +0200

Filipus Klutiero wrote:
> Rene, what evidence is there that this bug affects Etch?

Because I somehow thought the sarge-security fixed libfreetype6 went
into etch, too thorough the propagation mechanism (or at least did so).
also got a report on etch after that upgrade with that version number.

Anyway, now the etch tag of course is bogus.

Regards,

Rene

Message #51 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Kai Wasserbaech <kai.wasserbaech@carbon-project.org>

To: Debian Bug Tracking System <372719@bugs.debian.org>

Subject: Very small documents....

Date: Tue, 20 Jun 2006 13:18:31 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package: libfreetype6
Version: 2.1.7-2.4
Followup-For: Bug #372719

Jérôme Bertorelle <jerome@sequans.com> wrote:
> The crash occurs when saving a file. Bob's problem is probably related
> to the autosave feature (try to automatically save after a while, and 
> triggers the bug).
> 
> The bug is not systematic, for very small document saving may succeed.

Very small? you mean up to two lines without a blank line and both lines
shouldn't be formatted (not even a bold word). That's damn small.
But I can confirm that a downgrade works. First I suspected the
Mathematica Fonts (for MathML in Firefox) but after I traced the error
I've got the pretty same result as Jérôme.
Greetings
Kai



- --

Kai Wasserbaech

E-Mail: kai.wasserbaech@carbon-project.org
ICQ #127626442
URL: http://www.carbon-project.org/
GnuPG-Key: 0x74048C9A
(http://pgpkeys.pca.dfn.de:11371/pks/lookup?search=0x74048C9A&fingerprint=on&hash=on&op=vindex)


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQGVAwUBRJfZgViAl690BIyaAQqWlgv9Gv/QxZ/pXLuCZJDvSdKrodljgFETLYCz
o9R+tSe7sKQAu0jm/ZGatUYo6lAXHhkbL0wE6xhBc7wXm9emmf73ctAbI/8kUYI+
L4W8ckA/7mkvG0sMOy6nuZFQiUx4Nt0C4FW3pa+c3J/FUWd5lwCdYYIbPg2WK9KV
QWLXCj22E8LIbNsN3iNld/R0ePVWb2aVpzTAUZSnPv4ARWWBR3Rc5k8JjE9sefqg
csZEQziIZ67wEHyjVRmM1gioazdQSqXrB1k0yxyqEVU9LgDSLA1xzR50QbXvceBJ
GHxLZcVy9OHH8WsJ1c0Ej+dcLosLG60GLViLBEOSQxuLF0vD8CfyyqFPF79rKtha
UT8jO+5ydnyLj6YDw/oec8YMuXEWOdeRcqZ7xM55Nh/dF9ZyMrhlSrvMmQhXy6d0
fcYYZ5GFEHla0C5iV4+lfokkT6NjSWyQhZJwDNKr4lcK9JIx6HSanRoU7t+eQLd/
Vp7HdvuHgZElVubfM7l+7XGJBpp63xhr
=8pMn
-----END PGP SIGNATURE-----

Message #62 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Ennio-Sr <nasr.laili@tin.it>

To: 372719@bugs.debian.org

Subject: [Solved] OOo_2.0.2 crashes on saving Calc spreadsheets

Date: Sun, 25 Jun 2006 00:59:47 +0200

[Using Debian GNU/Linux, kernel 2.4.27-1-386]

Hi,

this is just to inform you that I've been experiencing the same problem
Bob reported, both using OOo_2.0.2  (.debs through alien) and OOo_2.0.3
i.e. debs available at :
ftp://ftp.linux.cz/pub/localization/OpenOffice.org/devel/680/2.0.3-RC5
as OOo_OOC680_m5_InuxIntel_install_en-GB.deb.tar.gz

Either downgrading libfreetype6 to 2.1.7-2.4 or installing the
2.1.7-3-i386.deb package provided by Steve Langasek has proved to be a
good cure on my box ;)

Thanks to all of you.
Regards,
	Ennio.

-- 
[Perche' usare Win$ozz (dico io) se ..."anche uno sciocco sa farlo.   \\?//
 Fa' qualche cosa di cui non sei capace!"  (diceva Henry Miller) ]    (°|°)
[Why use Win$ozz (I say) if ... "even a fool can do that.              )=(
 Do something you aren't good at!" (as Henry Miller used to say) ]

Message #87 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Debian Security Team <team@security.debian.org>

Cc: 372719@bugs.debian.org

Subject: regression in FreeType security fix for DSA-1095

Date: Sun, 25 Jun 2006 15:09:51 -0700

[Message part 1 (text/plain, inline)]

Hi guys,

As mentioned earlier this month, a regression was found in the freetype
2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
with division-by-zero errors.  I've prepared a maintainer upload to fix
this regression using the patch from bug #373581, which can be found at
<http://people.debian.org/~vorlon/freetype-DSA/>.

Can I upload this to security.d.o for a revised DSA?

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

[signature.asc (application/pgp-signature, inline)]

Message #92 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Kemp <skx@debian.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Mon, 26 Jun 2006 08:36:07 +0100

[Message part 1 (text/plain, inline)]

On Sun, Jun 25, 2006 at 03:09:51PM -0700, Steve Langasek wrote:

> As mentioned earlier this month, a regression was found in the freetype
> 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> with division-by-zero errors.  I've prepared a maintainer upload to fix
> this regression using the patch from bug #373581, which can be found at
> <http://people.debian.org/~vorlon/freetype-DSA/>.
> 
> Can I upload this to security.d.o for a revised DSA?

  Yes, please do.

Steve
-- 

[signature.asc (application/pgp-signature, inline)]

Message #97 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Steve Kemp <skx@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Mon, 26 Jun 2006 02:16:30 -0700

On Mon, Jun 26, 2006 at 08:36:07AM +0100, Steve Kemp wrote:
> On Sun, Jun 25, 2006 at 03:09:51PM -0700, Steve Langasek wrote:

> > As mentioned earlier this month, a regression was found in the freetype
> > 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> > with division-by-zero errors.  I've prepared a maintainer upload to fix
> > this regression using the patch from bug #373581, which can be found at
> > <http://people.debian.org/~vorlon/freetype-DSA/>.

> > Can I upload this to security.d.o for a revised DSA?

>   Yes, please do.

Uploaded.

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #108 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Fri, 7 Jul 2006 20:42:59 +0200

Hi!

Steve Langasek wrote:
> As mentioned earlier this month, a regression was found in the freetype
> 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> with division-by-zero errors.  I've prepared a maintainer upload to fix
> this regression using the patch from bug #373581, which can be found at
> <http://people.debian.org/~vorlon/freetype-DSA/>.

Are you sure this is the proper fix?

-+    if ((FT_ULong)pitch > LONG_MAX/height)
++    if (height != 0 && (FT_ULong)pitch > LONG_MAX/height)

I'd rather make it read:

    if (height <= 0 || (FT_ULong)pitch > LONG_MAX/height)

because later we have "pitch * height" which will result in a malloc
of zero.

That way, OOo won't crash anymore but may handle the font error
properly.

The package contains changes to debootstrap.log that should
not be there btw.

Regards,

	Joey

-- 
Reading is a lost art nowadays.  -- Michael Weber

Please always Cc to me when replying to me on the lists.

Message #113 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Steve Kemp <skx@debian.org>, Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Fri, 7 Jul 2006 20:44:22 +0200

Steve Langasek wrote:
> On Mon, Jun 26, 2006 at 08:36:07AM +0100, Steve Kemp wrote:
> > On Sun, Jun 25, 2006 at 03:09:51PM -0700, Steve Langasek wrote:
> 
> > > As mentioned earlier this month, a regression was found in the freetype
> > > 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> > > with division-by-zero errors.  I've prepared a maintainer upload to fix
> > > this regression using the patch from bug #373581, which can be found at
> > > <http://people.debian.org/~vorlon/freetype-DSA/>.
> 
> > > Can I upload this to security.d.o for a revised DSA?
> 
> >   Yes, please do.
> 
> Uploaded.

Btw. where?  I can't see it.

Regards,

	Joey

-- 
Reading is a lost art nowadays.  -- Michael Weber

Please always Cc to me when replying to me on the lists.

Message #118 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Martin Schulze <joey@infodrom.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org, Steve Kemp <skx@debian.org>

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sat, 15 Jul 2006 02:34:56 -0700

[Message part 1 (text/plain, inline)]

On Fri, Jul 07, 2006 at 08:42:59PM +0200, Martin Schulze wrote:

> Steve Langasek wrote:
> > As mentioned earlier this month, a regression was found in the freetype
> > 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> > with division-by-zero errors.  I've prepared a maintainer upload to fix
> > this regression using the patch from bug #373581, which can be found at
> > <http://people.debian.org/~vorlon/freetype-DSA/>.

> Are you sure this is the proper fix?

> -+    if ((FT_ULong)pitch > LONG_MAX/height)
> ++    if (height != 0 && (FT_ULong)pitch > LONG_MAX/height)

It appears to be a correct fix for the regression that has been reported.

> I'd rather make it read:

>     if (height <= 0 || (FT_ULong)pitch > LONG_MAX/height)

> because later we have "pitch * height" which will result in a malloc
> of zero.

This 'pitch * height' is pre-existing code in 2.1.7-2.4 and users report no
problems with OOo running against that version of freetype.  I have not
traced the code to determine whether changing the returned error in the case
of a height of 0 has any side effects; given that there are no previous
complaints about height==0, I don't think this is a change that needs to be
made in a security update.

> The package contains changes to debootstrap.log that should
> not be there btw.

Hmm, so it does.  I've re-rolled the package to drop this spurious change
and am re-uploading it now.

On Fri, Jul 07, 2006 at 08:44:22PM +0200, Martin Schulze wrote:
> Steve Langasek wrote:
> > On Mon, Jun 26, 2006 at 08:36:07AM +0100, Steve Kemp wrote:
> > > On Sun, Jun 25, 2006 at 03:09:51PM -0700, Steve Langasek wrote:
> > 
> > > > As mentioned earlier this month, a regression was found in the freetype
> > > > 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> > > > with division-by-zero errors.  I've prepared a maintainer upload to fix
> > > > this regression using the patch from bug #373581, which can be found at
> > > > <http://people.debian.org/~vorlon/freetype-DSA/>.
> > 
> > > > Can I upload this to security.d.o for a revised DSA?
> > 
> > >   Yes, please do.

> > Uploaded.

> Btw. where?  I can't see it.

Successfully uploaded freetype_2.1.7-3.dsc to security-master.debian.org.
Successfully uploaded freetype_2.1.7-3.diff.gz to security-master.debian.org.
Successfully uploaded libfreetype6_2.1.7-3_i386.deb to security-master.debian.org.
Successfully uploaded libfreetype6-dev_2.1.7-3_i386.deb to security-master.debian.org.
Successfully uploaded freetype2-demos_2.1.7-3_i386.deb to security-master.debian.org.
Successfully uploaded libfreetype6-udeb_2.1.7-3_i386.udeb to security-master.debian.org.
Successfully uploaded freetype_2.1.7-3_i386.changes to security-master.debian.org.

This was done with distribution=stable-security.  Hopefully the second try
won't disappear also...

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

[signature.asc (application/pgp-signature, inline)]

Message #123 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Pigeon <pigeon@pigeon.dyndns.org>

To: 372719@bugs.debian.org

Subject: Freetype and OpenOffice

Date: Thu, 20 Jul 2006 23:12:34 +0100

[Message part 1 (text/plain, inline)]

A similar problem occurs with openoffice 1.1.3 in sarge although in
this case the crash occurs not when saving a file but when launching
the application. Again, downgrading to libfreetype6_2.1.7-2.4 solved
the problem, as did upgrading to libfreetype6_2.1.7-3.

-- 
Pigeon

Be kind to pigeons
Get my GPG key here: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x21C61F7F

[signature.asc (application/pgp-signature, inline)]

Message #128 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sun, 23 Jul 2006 20:51:29 +0200

Steve Langasek wrote:
> On Fri, Jul 07, 2006 at 08:42:59PM +0200, Martin Schulze wrote:
> 
> > Steve Langasek wrote:
> > > As mentioned earlier this month, a regression was found in the freetype
> > > 2.1.7-2.5 package uploaded for DSA-1095 which caused applications to crash
> > > with division-by-zero errors.  I've prepared a maintainer upload to fix
> > > this regression using the patch from bug #373581, which can be found at
> > > <http://people.debian.org/~vorlon/freetype-DSA/>.
> 
> > Are you sure this is the proper fix?
> 
> > -+    if ((FT_ULong)pitch > LONG_MAX/height)
> > ++    if (height != 0 && (FT_ULong)pitch > LONG_MAX/height)
> 
> It appears to be a correct fix for the regression that has been reported.
> 
> > I'd rather make it read:
> 
> >     if (height <= 0 || (FT_ULong)pitch > LONG_MAX/height)
> 
> > because later we have "pitch * height" which will result in a malloc
> > of zero.

s/of zero/of less than zero/ it should have read, i.e. a negative malloc
which is general a bad thing.

> This 'pitch * height' is pre-existing code in 2.1.7-2.4 and users report no
> problems with OOo running against that version of freetype.  I have not
> traced the code to determine whether changing the returned error in the case
> of a height of 0 has any side effects; given that there are no previous
> complaints about height==0, I don't think this is a change that needs to be
> made in a security update.

Yeah, height==0 is evil, but height<0 is evil as well and will result
in "interesting" results, hence, should be avoided as well.

I still see

--- freetype-2.1.7.orig/--variant=buildd/debootstrap/debootstrap.log
+++ freetype-2.1.7/--variant=buildd/debootstrap/debootstrap.log
@@ -0,0 +1,2 @@
+/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory
+/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory

which ought not to be there.  Please build the source package before
building the binary package and review the change with interdiff -z.

Regards,

	Joey

-- 
Long noun chains don't automatically imply security.  -- Bruce Schneier

Please always Cc to me when replying to me on the lists.

Message #133 received at 372719@bugs.debian.org (full text, mbox, reply):

From: "Mgr. Peter Tuharsky" <tuharsky@misbb.sk>

To: 372719@bugs.debian.org

Subject: Freetype and OpenOffice

Date: Tue, 01 Aug 2006 08:36:46 +0200

Hallo, guys.

Please, could the corrected package at last make it to official security 
upgrades? It's over 6 weeks, the reason and solution is well known, so 
why it just cannost be fixed the same way for the end user, that it has 
been caused? I check every day for security upgrade that would correct 
the broken freetype. OOo20 crashes, WINE as well, quite confusing..

I like the security upgrades less than yesterday and more than tomorrow, 
because quite often they just cause things to stop working. Before, I 
was curious about Microsoft's patches that made more harm than good. 
We're just approaching that kind of quality.


   Peter

Message #138 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Oskar Pearson <oskar@qualica.com>

To: 372719@bugs.debian.org

Subject: Please can someone sort this out! Pretty please with a cherry on top?

Date: Fri, 04 Aug 2006 10:04:55 +0200

Hi there

This problem is consistently causing issues for me and numerous other people..

I don't really have much to add to this bug request, other than to consider
this a vote for "please look at this if you have some time - it'd be much
appreciated".

I know you guys have hundreds of other things to look at, but this seems to
have fallen by the wayside somehow..

Thanks, both for this and for all the work you (collectively) do on Debian
- it's greatly appreciated.

Oskar

Message #143 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Ralph Katz <ralph.katz@rcn.com>

To: debian-devel@lists.debian.org

Cc: 372719@bugs.debian.org

Subject: Re: Surpassing Microsoft quality

Date: Wed, 16 Aug 2006 10:22:56 -0400

For me, there is no problem with OOo on sarge:

~$ uname -a
Linux magic 2.6.8-3-686 #1 Sat Jul 15 10:32:25 UTC 2006 i686 GNU/Linux

libfreetype6   		2.1.7-2.5
openoffice.org-writer 	2.0.3-1bpo1  from backports.org

Regards,
Ralph

Message #148 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Rob Walker <rob@tenfoot.org.uk>

To: 372719@bugs.debian.org

Subject: Also affects xfs with truetype fonts

Date: Fri, 18 Aug 2006 11:09:54 +0100

This bug also causes xfs to crash if I use truetype fonts from X applications 
that don't do anti-aliasing (e.g. emacs, xfontsel).

Downgrading to libfreetype6 2.1.7-2.4 fixes the problem.

Rob

Message #153 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Martin Schulze <joey@infodrom.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sat, 19 Aug 2006 00:07:45 -0700

On Sun, Jul 23, 2006 at 08:51:29PM +0200, Martin Schulze wrote:
> Steve Langasek wrote:
> > On Fri, Jul 07, 2006 at 08:42:59PM +0200, Martin Schulze wrote:

> > It appears to be a correct fix for the regression that has been reported.

> > > I'd rather make it read:

> > >     if (height <= 0 || (FT_ULong)pitch > LONG_MAX/height)

> > > because later we have "pitch * height" which will result in a malloc
> > > of zero.

> s/of zero/of less than zero/ it should have read, i.e. a negative malloc
> which is general a bad thing.

Ok, that's fair.  I think there's still the possibility of a negative malloc
if pitch is negative, but that's now several steps removed from the stated
vulnerability, and in the meantime we still have the crasher regression, so
I've updated the patch to use the height <= 0 check.

> I still see

> --- freetype-2.1.7.orig/--variant=buildd/debootstrap/debootstrap.log
> +++ freetype-2.1.7/--variant=buildd/debootstrap/debootstrap.log
> @@ -0,0 +1,2 @@
> +/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory
> +/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory
> 
> which ought not to be there.

Well, apparently the -3 package that you said you couldn't find was on
security.d.o all along, because this was *not* in the second -3 package that
I uploaded; but that one was rejected because it was a duplicate.

I've uploaded -4 now with the additional check.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #158 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sat, 19 Aug 2006 09:28:46 +0200

Steve Langasek wrote:
> On Sun, Jul 23, 2006 at 08:51:29PM +0200, Martin Schulze wrote:
> > Steve Langasek wrote:
> > > On Fri, Jul 07, 2006 at 08:42:59PM +0200, Martin Schulze wrote:
> 
> > > It appears to be a correct fix for the regression that has been reported.
> 
> > > > I'd rather make it read:
> 
> > > >     if (height <= 0 || (FT_ULong)pitch > LONG_MAX/height)
> 
> > > > because later we have "pitch * height" which will result in a malloc
> > > > of zero.
> 
> > s/of zero/of less than zero/ it should have read, i.e. a negative malloc
> > which is general a bad thing.
> 
> Ok, that's fair.  I think there's still the possibility of a negative malloc
> if pitch is negative, but that's now several steps removed from the stated
> vulnerability, and in the meantime we still have the crasher regression, so
> I've updated the patch to use the height <= 0 check.
> 
> > I still see
> 
> > --- freetype-2.1.7.orig/--variant=buildd/debootstrap/debootstrap.log
> > +++ freetype-2.1.7/--variant=buildd/debootstrap/debootstrap.log
> > @@ -0,0 +1,2 @@
> > +/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory
> > +/usr/sbin/debootstrap: line 349: .: /chroots/sarge-i386-pristine: is a directory
> > 
> > which ought not to be there.
> 
> Well, apparently the -3 package that you said you couldn't find was on
> security.d.o all along, because this was *not* in the second -3 package that
> I uploaded; but that one was rejected because it was a duplicate.
> 
> I've uploaded -4 now with the additional check.

Oh damn you!

This way we won't get an update any time.

I was tying to build -2.5 with no luck, then just started with -3.1 to
fix your invisible -3 build, and just no you've deciced to upload -4
which is also invisible to us and which most probably blocks -3.1 from
building - as I see -4 build logs.  Thanks you very much.

-- 
Unix is user friendly ...  It's just picky about its friends.

Please always Cc to me when replying to me on the lists.

Message #163 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Martin Schulze <joey@infodrom.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sat, 19 Aug 2006 01:28:18 -0700

On Sat, Aug 19, 2006 at 09:28:46AM +0200, Martin Schulze wrote:
> > Well, apparently the -3 package that you said you couldn't find was on
> > security.d.o all along, because this was *not* in the second -3 package that
> > I uploaded; but that one was rejected because it was a duplicate.

> > I've uploaded -4 now with the additional check.

> I was tying to build -2.5 with no luck, then just started with -3.1 to
> fix your invisible -3 build, and just no you've deciced to upload -4
> which is also invisible to us and which most probably blocks -3.1 from
> building - as I see -4 build logs.  Thanks you very much.

Gee, thanks for swearing at me.  How is it *my* fault that you can't see
builds that are being uploaded to the documented queue on
security.debian.org, and why did you not bother to let *me* know that
something had changed with the package when I'd previously been given
approval to upload?  I'm sure I could've found something else to do with my
time tonight besides trying to help clean up after your broken DSA build.

Either way, I guess this bug is not my problem any more, since I apparently
can't contribute anything useful to fixing it and am not sure I would want
to if there was.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #168 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: Debian Security Team <team@security.debian.org>, 372719@bugs.debian.org

Subject: Re: regression in FreeType security fix for DSA-1095

Date: Sat, 19 Aug 2006 16:23:50 +0200

Hi!

First of all, I'd like to apologise for my harsh words.  I spent the last
days nearly only on Debian issues including a lot of security and buildd
work and yesterday had just decided to not wait for your answer to a mail
from nearly one month ago and go ahead with the upload.

Steve Langasek wrote:
> On Sat, Aug 19, 2006 at 09:28:46AM +0200, Martin Schulze wrote:
> > > Well, apparently the -3 package that you said you couldn't find was on
> > > security.d.o all along, because this was *not* in the second -3 package that
> > > I uploaded; but that one was rejected because it was a duplicate.
> 
> > > I've uploaded -4 now with the additional check.
> 
> > I was tying to build -2.5 with no luck, then just started with -3.1 to
> > fix your invisible -3 build, and just no you've deciced to upload -4
> > which is also invisible to us and which most probably blocks -3.1 from
> > building - as I see -4 build logs.  Thanks you very much.
> 
> Gee, thanks for swearing at me.  How is it *my* fault that you can't see
> builds that are being uploaded to the documented queue on
> security.debian.org, and why did you not bother to let *me* know that
> something had changed with the package when I'd previously been given
> approval to upload?  I'm sure I could've found something else to do with my
> time tonight besides trying to help clean up after your broken DSA build.

As I said, I've sent you a mail nearly one month ago apparently (according
to the date in the greeting of the mail you responded).  I was waiting for
your approval but it didn't happen until today.

> Either way, I guess this bug is not my problem any more, since I apparently
> can't contribute anything useful to fixing it and am not sure I would want
> to if there was.

Neither can I.

Maybe it's better to fix it via proposed-updates and let the SRM team
decide.

Regards,

	Joey

-- 
Unix is user friendly ...  It's just picky about its friends.

Please always Cc to me when replying to me on the lists.

Message #173 received at 372719-done@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Martin Schulze <joey@infodrom.org>, 372719-done@bugs.debian.org

Subject: Re: Bug#372719: regression in FreeType security fix for DSA-1095

Date: Fri, 1 Sep 2006 03:17:49 -0700

Version: 2.1.7-5

On Sat, Aug 19, 2006 at 04:23:50PM +0200, Martin Schulze wrote:
> Maybe it's better to fix it via proposed-updates and let the SRM team
> decide.

This has happened now, and is r3.  It's regrettable that we couldn't get it
out in a DSA update, but it's at least done for users who will upgrade from
stable.

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #209 received at 372719-done@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: Steve Langasek <vorlon@debian.org>

Cc: 372719-done@bugs.debian.org

Subject: Re: Bug#372719: regression in FreeType security fix for DSA-1095

Date: Fri, 1 Sep 2006 12:33:02 +0200

Steve Langasek wrote:
> Version: 2.1.7-5
> 
> On Sat, Aug 19, 2006 at 04:23:50PM +0200, Martin Schulze wrote:
> > Maybe it's better to fix it via proposed-updates and let the SRM team
> > decide.
> 
> This has happened now, and is r3.  It's regrettable that we couldn't get it
> out in a DSA update, but it's at least done for users who will upgrade from
> stable.

Good, at least it's fixed now.

Regards,

	Joey

-- 
If you come from outside of Finland, you live in wrong country.
	-- motd of irc.funet.fi

Please always Cc to me when replying to me on the lists.

Message #214 received at 372719@bugs.debian.org (full text, mbox, reply):

From: "Mgr. Peter Tuharsky" <tuharsky@misbb.sk>

To: 372719@bugs.debian.org

Subject: Bug#372719: regression in FreeType security fix for DSA-1095

Date: Tue, 05 Sep 2006 09:58:24 +0200

Thank You, seems it works now.

Peter

Message #219 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Bernd Schubert <bernd-schubert@gmx.de>

To: 372719@bugs.debian.org

Subject: Re: Bug#372719: regression in FreeType security fix for DSA-1095

Date: Mon, 11 Sep 2006 20:45:06 +0200

> Version: 2.1.7-5
> 
> On Sat, Aug 19, 2006 at 04:23:50PM +0200, Martin Schulze wrote:
> > Maybe it's better to fix it via proposed-updates and let the SRM team
> > decide.
> 
> This has happened now, and is r3.  It's regrettable that we couldn't get it
> out in a DSA update, but it's at least done for users who will upgrade from
> stable.

Sorry for my dumb question, but where do I find the latest package? I don't 
see any recent libfreetype6 security updates and also sarge-proposed-updates 
doesn't have anything about libfreetype6? On vorlons site  
(http://people.debian.org/~vorlon/) there's also only the -3 package from 
june.

Another question, did you discuss this issue with upstream? I mean, if there's 
some dispute on how it should be solved, shouldn't upstream be at least 
asked? This also applies to #367593, I searched the freetype list archives, 
but didn't find anything recent about debian bugs. 


Thanks,
Bernd

-- 
Bernd Schubert
PCI / Theoretische Chemie
Universität Heidelberg
INF 229
69120 Heidelberg

Message #224 received at 372719@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Bernd Schubert <bernd-schubert@gmx.de>, 372719@bugs.debian.org

Subject: Re: Bug#372719: regression in FreeType security fix for DSA-1095

Date: Mon, 11 Sep 2006 14:34:06 -0700

On Mon, Sep 11, 2006 at 08:45:06PM +0200, Bernd Schubert wrote:

> > On Sat, Aug 19, 2006 at 04:23:50PM +0200, Martin Schulze wrote:
> > > Maybe it's better to fix it via proposed-updates and let the SRM team
> > > decide.

> > This has happened now, and is r3.  It's regrettable that we couldn't get it
> > out in a DSA update, but it's at least done for users who will upgrade from
> > stable.

> Sorry for my dumb question, but where do I find the latest package? I don't 
> see any recent libfreetype6 security updates and also sarge-proposed-updates 
> doesn't have anything about libfreetype6?

It's in stable.  sarge-proposed-updates is a staging ground; this package
has been included in the latest sarge point release.

> Another question, did you discuss this issue with upstream?

No.

> I mean, if there's some dispute on how it should be solved, shouldn't
> upstream be at least asked?

I don't see that there is any dispute on how it should be solved.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Send a report that this bug log contains spam.