Debian Bug report logs - #439855
libsdl-pango1: free(): invalid pointer

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jens Seidel <jensseidel@users.sf.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libsdl-pango1: free(): invalid pointer

Date: Tue, 28 Aug 2007 00:12:39 +0200

[Message part 1 (text/plain, inline)]

Package: libsdl-pango1
Version: 0.1.2-1
Severity: normal

Hi,

I noticed a crash which happens if SDLPango_SetText_GivenAlignment is
used with a small maximal size. SDLPango_SetText seems not to be
affected so it may be a bug in the API extension bug. 

A workaround is to increase the maximal width to the text width (which
may be large if no linebreaks are found).

This bug happened again in hex-a-hop which seems to be a good test case
for SDL Pango. See #439393 with debian/ from svn, revision 3860.

I suggest to test this also with the height instead of width. What
happens if the text size is larger than window width? Another crash?
There are many corner cases which should explicetely be tested!

I attached a test file based on a simplified testbench.c program from
SDL Pango source.

$ ./testbench
*** glibc detected *** ./testbench: free(): invalid pointer: 0x0809d900 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7d7915e]
/lib/libc.so.6(cfree+0x90)[0xb7d7c7b0]
/usr/lib/libSDL-1.2.so.0(SDL_FreeSurface+0xda)[0xb7e87eaa]
./testbench[0x80488f7]
/lib/libc.so.6(__libc_start_main+0xdc)[0xb7d26ebc]
./testbench[0x80487a1]
======= Memory map: ========
08048000-08049000 r-xp 00000000 08:01 4244160    /tmp/testbench
08049000-0804a000 rw-p 00000000 08:01 4244160    /tmp/testbench
0804a000-080ab000 rw-p 0804a000 00:00 0          [heap]
b7400000-b7421000 rw-p b7400000 00:00 0
b7421000-b7500000 ---p b7421000 00:00 0
b75cc000-b75d6000 r-xp 00000000 08:01 5341566    /lib/libgcc_s.so.1
b75d6000-b75d7000 rw-p 00009000 08:01 5341566    /lib/libgcc_s.so.1
b75e9000-b75fa000 r--p 00000000 08:01 4034445    /usr/share/fonts/truetype/ttf-bitstream-vera/Vera.ttf
b75fa000-b75fc000 r-xp 00000000 08:01 3916715    /usr/lib/pango/1.5.0/modules/pango-basic-fc.so
b75fc000-b75fd000 rw-p 00001000 08:01 3916715    /usr/lib/pango/1.5.0/modules/pango-basic-fc.so
b75fd000-b7603000 r--s 00000000 08:01 1360299    /var/cache/fontconfig/945677eb7aeaf62f1d50efc3fb3ec7d8-x86.cache-2
b7603000-b7604000 r--s 00000000 08:01 1363024    /var/cache/fontconfig/75a2cd575a62c63e802c11411fb87c37-x86.cache-2
b7604000-b760a000 r--s 00000000 08:01 1363023    /var/cache/fontconfig/6d41288fd70b0be22e8c3a91e032eec0-x86.cache-2
b760a000-b760c000 r--s 00000000 08:01 1363022    /var/cache/fontconfig/de156ccd2eddbdc19d37a45b8b2aac9c-x86.cache-2
b760c000-b7612000 r--s 00000000 08:01 1363020    /var/cache/fontconfig/d52a8644073d54c13679302ca1180695-x86.cache-2
b7612000-b7616000 r--s 00000000 08:01 1363019    /var/cache/fontconfig/105b9c7e6f0a4f82d8c9b6e39c52c6f9-x86.cache-2
b7616000-b7627000 r--s 00000000 08:01 5179340    /home/jens/.fontconfig/cabbd14511b9e8a55e92af97fb3a0461-x86.cache-2
b7627000-b7629000 r--s 00000000 08:01 1363014    /var/cache/fontconfig/e13b20fdb08344e0e664864cc2ede53d-x86.cache-2
b7629000-b7669000 r--s 00000000 08:01 1363013    /var/cache/fontconfig/eeebfc908bd29a90773fd860017aada4-x86.cache-2
b7669000-b76a9000 r--s 00000000 08:01 1363010    /var/cache/fontconfig/21a99156bb11811cef641abeda519a45-x86.cache-2
b76a9000-b76aa000 r--s 00000000 08:01 1347065    /var/cache/fontconfig/bf1f9632594a1fa28e2cf4d7888deffe-x86.cache-2
b76aa000-b76ad000 r--s 00000000 08:01 1363031    /var/cache/fontconfig/b21a91cee725896328b8cee8091cf747-x86.cache-2
b76ad000-b76ae000 r--s 00000000 08:01 1347863    /var/cache/fontconfig/059138ec877db160474b4d5de1248d14-x86.cache-2
b76ae000-b76af000 r--s 00000000 08:01 1347063    /var/cache/fontconfig/118d8d5311348bbdf5fe3b106d7c13d4-x86.cache-2
b76af000-b76b2000 r--s 00000000 08:01 1363029    /var/cache/fontconfig/8ab5f685cd6d8ba67c37c908faf08172-x86.cache-2
b76b2000-b76bb000 r-xp 00000000 08:01 5344796    /lib/libnss_files-2.5.so
b76bb000-b76bd000 rw-p 00008000 08:01 5344796    /lib/libnss_files-2.5.so
b76bd000-b76c5000 r-xp 00000000 08:01 5341625    /lib/libnss_nis-2.5.so
b76c5000-b76c7000 rw-p 00007000 08:01 5341625    /lib/libnss_nis-2.5.so
b76c7000-b76da000 r-xp 00000000 08:01 5341338    /lib/libnsl-2.5.so
b76da000-b76dc000 rw-p 00012000 08:01 5341338    /lib/libnsl-2.5.so
b76dc000-b76de000 rw-p b76dc000 00:00 0
b76df000-b76e0000 r--s 00000000 08:01 1347177    /var/cache/fontconfig/142ecfc435bad6f1fbc2648c1119d5eb-x86.cache-2
b76e0000-b76e6000 r--s 00000000 08:01 1363028    /var/cache/fontconfig/102e5142c2e9e50c5e8ece26694a2dad-x86.cache-2
b76e6000-b76e7000 r--s 00000000 08:01 1347059    /var/cache/fontconfig/92a571655fb1c0ec1c4d6f496220600a-x86.cache-2
b76e7000-b76ef000 r--s 00000000 08:01 1347864    /var/cache/fontconfig/a960c40fc9306f090224a04585f8a963-x86.cache-2
b76ef000-b76f0000 r--s 00000000 08:01 1363009    /var/cache/fontconfig/9404ff413c67fc2a1526fd14eb4163a8-x86.cache-2
b76f0000-b781c000 rw-s 00000000 00:08 298942480  /SYSV00000000 (deleted)
b781c000-b7820000 r-xp 00000000 08:01 3834148    /usr/lib/libXfixes.so.3.1.0
b7820000-b7821000 rw-p 00003000 08:01 3834148    /usr/lib/libXfixes.so.3.1.0
b7821000-b7829000 r-xp 00000000 08:01 3834126    /usr/lib/libXcursor.so.1.0.2
b7829000-b782a000 rw-p 00007000 08:01 3834126    /usr/lib/libXcursor.so.1.0.2
b782a000-b782c000 r-xp 00000000 08:01 3833930    /usr/lib/libXrandr.so.2.0.0
b782c000-b782d000 rw-p 00002000 08:01 3833930    /usr/lib/libXrandr.so.2.0.0
b782d000-b7834000 r-xp 00000000 08:01 3839920    /usr/lib/libXrender.so.1.3.0
b7834000-b7835000 rw-p 00006000 08:01 3839920    /usr/lib/libXrender.so.1.3.0
b7835000-b7842000 r-xp 00000000 08:01 3834964    /usr/lib/libXext.so.6.4.0
b7842000-b7843000 rw-p 0000c000 08:01 3834964    /usr/lib/libXext.so.6.4.0
b7843000-b7847000 r-xp 00000000 08:01 3834946    /usr/lib/libXdmcp.so.6.0.0
b7847000-b7848000 rw-p 00003000 08:01 3834946    /usr/lib/libXdmcp.so.6.0.0
b7848000-b784a000 r-xp 00000000 08:01 3834944    /usr/lib/libXau.so.6.0.0
b784a000-b784b000 rw-p 00001000 08:01 3834944    /usr/lib/libXau.so.6.0.0
b784b000-b7933000 r-xp 00000000 08:01 3835850    /usr/lib/libX11.so.6.2.0
b7933000-b7937000 rw-p 000e8000 08:01 3835850    /usr/lib/libX11.so.6.2.0
b7937000-b7939000 rw-p b7937000 00:00 0
b7939000-b7957000 r-xp 00000000 08:01 3835862    /usr/lib/libexpat.so.1.0.0
b7957000-b7959000 rw-p 0001d000 08:01 3835862    /usr/lib/libexpat.so.1.0.0
b7959000-b7960000 r-xp 00000000 08:01 5341370    /lib/librt-2.5.so
b7960000-b7962000 rw-p 00006000 08:01 5341370    /lib/librt-2.5.so
b7962000-b7975000 r-xp 00000000 08:01 3835883    /usr/lib/libz.so.1.2.3
b7975000-b7976000 rw-p 00012000 08:01 3835883    /usr/lib/libz.so.1.2.3
b7976000-b79dd000 r-xp 00000000 08:01 3837177    /usr/lib/libfreetype.so.6.3.10
b79dd000-b79e0000 rw-p 00067000 08:01 3837177    /usr/lib/libfreetype.so.6.3.10
b79e0000-b7a03000 r-xp 00000000 08:01 3834339    /usr/lib/libfontconfig.so.1.2.0
b7a03000-b7a0b000 rw-p 00023000 08:01 3834339    /usr/lib/libfontconfig.so.1.2.0
b7a0b000-b7a0c000 rw-p b7a0b000 00:00 0
b7a0c000-b7a9d000 r-xp 00000000 08:01 3834661    /usr/lib/libglib-2.0.so.0.1200.4
b7a9d000-b7a9e000 rw-p 00091000 08:01 3834661    /usr/lib/libglib-2.0.so.0.1200.4
b7a9e000-b7aa0000 r-xp 00000000 08:01 3834737    /usr/lib/libgmodule-2.0.so.0.1200.4
b7aa0000-b7aa1000 rw-p 00002000 08:01 3834737    /usr/lib/libgmodule-2.0.so.0.1200.4
b7aa1000-b7ada000 r-xp 00000000 08:01 3834736    /usr/lib/libgobject-2.0.so.0.1200.4
b7ada000-b7adb000 rw-p 00039000 08:01 3834736    /usr/lib/libgobject-2.0.so.0.1200.4
b7adb000-b7b13000 r-xp 00000000 08:01 3835638    /usr/lib/libpango-1.0.so.0.1400.8
b7b13000-b7b15000 rw-p 00038000 08:01 3835638    /usr/lib/libpango-1.0.so.0.1400.8
b7b15000-b7b3f000 r-xp 00000000 08:01 5079504    /usr/lib/libpangoft2-1.0.so.0.1400.8
b7b3f000-b7b40000 rw-p 00029000 08:01 5079504    /usr/lib/libpangoft2-1.0.so.0.1400.8
b7b40000-b7b41000 rw-p b7b40000 00:00 0
b7b41000-b7b54000 r-xp 00000000 08:01 5344787    /lib/libpthread-2.5.so
b7b54000-b7b56000 rw-p 00012000 08:01 5344787    /lib/libpthread-2.5.so
b7b56000-b7b58000 rw-p b7b56000 00:00 0
b7b58000-b7ba8000 r-xp 00000000 08:01 3845607    /usr/lib/libvga.so.1.4.3
b7ba8000-b7baf000 rw-p 00050000 08:01 3845607    /usr/lib/libvga.so.1.4.3
b7baf000-b7bb8000 rw-p b7baf000 00:00 0
b7bb8000-b7bc6000 r-xp 00000000 08:01 3845557    /usr/lib/libdirect-0.9.so.25.0.0
b7bc6000-b7bc7000 rw-p 0000d000 08:01 3845557    /usr/lib/libdirect-0.9.so.25.0.0
b7bc7000-b7bcc000 r-xp 00000000 08:01 3845558    /usr/lib/libfusion-0.9.so.25.0.0
b7bcc000-b7bcd000 rw-p 00004000 08:01 3845558    /usr/lib/libfusion-0.9.so.25.0.0
b7bcd000-b7c22000 r-xp 00000000 08:01 3845559    /usr/lib/libdirectfb-0.9.so.25.0.0
b7c22000-b7c24000 rw-p 00054000 08:01 3845559    /usr/lib/libdirectfb-0.9.so.25.0.0
b7c24000-b7c25000 rw-p b7c24000 00:00 0
b7c25000-b7c27000 r-xp 00000000 08:01 5341344    /lib/libdl-2.5.so
b7c27000-b7c29000 rw-p 00001000 08:01 5341344    /lib/libdl-2.5.so
b7c29000-b7c4e000 r-xp 00000000 08:01 5341340    /lib/libm-2.5.so
b7c4e000-b7c50000 rw-p 00024000 08:01 5341340    /lib/libm-2.5.so
b7c50000-b7d0c000 r-xp 00000000 08:01 3834141    /usr/lib/libasound.so.2.0.0
b7d0c000-b7d11000 rw-p 000bb000 08:01 3834141    /usr/lib/libasound.so.2.0.0
b7d11000-b7e4e000 r-xp 00000000 08:01 5341345    /lib/libc-2.5.so
b7e4e000-b7e4f000 r--p 0013d000 08:01 5341345    /lib/libc-2.5.so
b7e4f000-b7e51000 rw-p 0013e000 08:01 5341345    /lib/libc-2.5.so
b7e51000-b7e54000 rw-p b7e51000 00:00 0
b7e54000-b7e57000 r-xp 00000000 08:01 3845856    /usr/lib/libSDL_Pango.so.1.1.0
b7e57000-b7e58000 rw-p 00002000 08:01 3845856    /usr/lib/libSDL_Pango.so.1.1.0
b7e58000-b7ebf000 r-xp 00000000 08:01 3834144    /usr/lib/libSDL-1.2.so.0.11.0
b7ebf000-b7ec1000 rw-p 00067000 08:01 3834144    /usr/lib/libSDL-1.2.so.0.11.0
b7ec1000-b7f0a000 rw-p b7ec1000 00:00 0
b7f0a000-b7f0c000 r--s 00000000 08:01 1347057    /var/cache/fontconfig/b3fedf7c409f006ca1a6fceffceb77cf-x86.cache-2
b7f0c000-b7f13000 r-xp 00000000 08:01 5341346    /lib/libnss_compat-2.5.so
b7f13000-b7f15000 rw-p 00006000 08:01 5341346    /lib/libnss_compat-2.5.so
b7f15000-b7f1c000 r--s 00000000 08:01 3833935    /usr/lib/gconv/gconv-modules.cache
b7f1c000-b7f1d000 rw-p b7f1c000 00:00 0
b7f1d000-b7f1e000 r-xp b7f1d000 00:00 0          [vdso]
b7f1e000-b7f39000 r-xp 00000000 08:01 5341335    /lib/ld-2.5.so
b7f39000-b7f3b000 rw-p 0001b000 08:01 5341335    /lib/ld-2.5.so
bfcc7000-bfcdd000 rw-p bfcc7000 00:00 0          [stack]
Abgebrochen

Jens

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-4-686
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)

Versions of packages libsdl-pango1 depends on:
ii  libc6                         2.5-7      GNU C Library: Shared libraries
ii  libglib2.0-0                  2.12.4-2   The GLib library of C routines
ii  libpango1.0-0                 1.14.8-5   Layout and rendering of internatio
ii  libsdl1.2debian               1.2.11-8   Simple DirectMedia Layer

libsdl-pango1 recommends no packages.

-- no debconf information

[testbench.c (text/x-csrc, attachment)]

Message #10 received at 439855@bugs.debian.org (full text, mbox, reply):

From: Josselin Mouette <joss@debian.org>

To: Jens Seidel <jensseidel@users.sf.net>, 439855@bugs.debian.org

Cc: pkg-sdl-maintainers@lists.alioth.debian.org

Subject: Re: Bug#439855: libsdl-pango1: free(): invalid pointer

Date: Tue, 18 Sep 2007 16:28:47 +0200

[Message part 1 (text/plain, inline)]

reassign 439855 libsdl1.2 1.2.11-9
thanks

Le mardi 28 août 2007 à 00:12 +0200, Jens Seidel a écrit :
> Package: libsdl-pango1
> Version: 0.1.2-1
> Severity: normal
> 
> Hi,
> 
> I noticed a crash which happens if SDLPango_SetText_GivenAlignment is
> used with a small maximal size. SDLPango_SetText seems not to be
> affected so it may be a bug in the API extension bug. 
> 
> A workaround is to increase the maximal width to the text width (which
> may be large if no linebreaks are found).
> 
> This bug happened again in hex-a-hop which seems to be a good test case
> for SDL Pango. See #439393 with debian/ from svn, revision 3860.
> 
> I suggest to test this also with the height instead of width. What
> happens if the text size is larger than window width? Another crash?
> There are many corner cases which should explicetely be tested!
> 
> I attached a test file based on a simplified testbench.c program from
> SDL Pango source.
> 
> $ ./testbench
> *** glibc detected *** ./testbench: free(): invalid pointer: 0x0809d900 ***
> ======= Backtrace: =========
> /lib/libc.so.6[0xb7d7915e]
> /lib/libc.so.6(cfree+0x90)[0xb7d7c7b0]
> /usr/lib/libSDL-1.2.so.0(SDL_FreeSurface+0xda)[0xb7e87eaa]
> ./testbench[0x80488f7]
> /lib/libc.so.6(__libc_start_main+0xdc)[0xb7d26ebc]
> ./testbench[0x80487a1]

I think this specific bug comes from SDL itself. The SDL_Surface comes
from a SDL_CreateRGBSurface call in SDLPango_CreateSurfaceDraw, and it
seems to be messed up in the way the pixels are allocated.

(gdb) bt
#0  0x00002b1f789876a5 in raise () from /lib/libc.so.6
#1  0x00002b1f78989100 in abort () from /lib/libc.so.6
#2  0x00002b1f789c054b in __libc_message () from /lib/libc.so.6
#3  0x00002b1f789c7a4a in _int_free () from /lib/libc.so.6
#4  0x00002b1f789cb63c in free () from /lib/libc.so.6
#5  0x00002b1f784c88fa in SDL_FreeSurface (surface=0x667770)
    at ../../src/video/SDL_surface.c:935
#6  0x0000000000400aa3 in main (argc=1, argv=0x7fff32828f08) at testbench.c:30


#5  0x00002b1f784c88fa in SDL_FreeSurface (surface=0x667770)
    at ../../src/video/SDL_surface.c:935
935                     SDL_free(surface->pixels);

(gdb) print *surface
$2 = {flags = 65536, format = 0x0, w = 131, h = 19, pitch = 524,
  pixels = 0x668000, offset = 0, hwdata = 0x0, clip_rect = {x = 0, y = 0,
    w = 131, h = 19}, unused1 = 0, locked = 0, map = 0x0, format_version = 3,
  refcount = 0}

-- 
 .''`.           Josselin Mouette        /\./\
: :' :           josselin.mouette@ens-lyon.org
`. `'                        joss@debian.org
  `-  Debian GNU/Linux -- The power of freedom

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 439855-close@bugs.debian.org (full text, mbox, reply):

From: Sam Hocevar (Debian packages) <sam+deb@zoy.org>

To: 439855-close@bugs.debian.org

Subject: Bug#439855: fixed in sdlpango 0.1.2-3

Date: Mon, 08 Oct 2007 20:47:17 +0000

Source: sdlpango
Source-Version: 0.1.2-3

We believe that the bug you reported is fixed in the latest version of
sdlpango, which is due to be installed in the Debian FTP archive:

libsdl-pango-dev_0.1.2-3_amd64.deb
  to pool/main/s/sdlpango/libsdl-pango-dev_0.1.2-3_amd64.deb
libsdl-pango1_0.1.2-3_amd64.deb
  to pool/main/s/sdlpango/libsdl-pango1_0.1.2-3_amd64.deb
sdlpango_0.1.2-3.diff.gz
  to pool/main/s/sdlpango/sdlpango_0.1.2-3.diff.gz
sdlpango_0.1.2-3.dsc
  to pool/main/s/sdlpango/sdlpango_0.1.2-3.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 439855@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sam Hocevar (Debian packages) <sam+deb@zoy.org> (supplier of updated sdlpango package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 08 Oct 2007 19:50:42 +0000
Source: sdlpango
Binary: libsdl-pango-dev libsdl-pango1
Architecture: source amd64
Version: 0.1.2-3
Distribution: unstable
Urgency: low
Maintainer: Debian SDL packages maintainers <pkg-sdl-maintainers@lists.alioth.debian.org>
Changed-By: Sam Hocevar (Debian packages) <sam+deb@zoy.org>
Description: 
 libsdl-pango-dev - text rendering with Pango in SDL applications (development)
 libsdl-pango1 - text rendering with Pango in SDL applications (shared library)
Closes: 439855
Changes: 
 sdlpango (0.1.2-3) unstable; urgency=low
 .
   * debian/control:
     + Set DEB_QUILT_PATCHDIR_LINK to avoid build failures.
     + Set the SDL team as the maintainer.
 .
   * debian/patches/blit_overflow.patch:
     + Fix a blit overflow if rect->x or rect->y < 0 (Closes: #439855).
Files: 
 1503d21d20fa2ba2c7f711d390d956da 828 libs optional sdlpango_0.1.2-3.dsc
 022fb664607b09ef5eb8db84b54dcf69 20576 libs optional sdlpango_0.1.2-3.diff.gz
 26648aadb44332f25b8b0145d7dff665 11122 libs optional libsdl-pango1_0.1.2-3_amd64.deb
 9ef4d37e44b02688ea8d03b0727d3abe 31598 libdevel optional libsdl-pango-dev_0.1.2-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHCovHfPP1rylJn2ERAsrWAJ0UjDz3ZmZyzBaLSuO8MGpp2Ve1qgCgriDB
MmUxpONhcd8JrCxUHjccTcA=
=M5ul
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.