[Pkg-fonts-devel] Bug#550120: fontforge segfaults when writing an SVG font

[Simon Tatham]

Package: fontforge
Version: 0.0.20080429-1

If I try to use FontForge to convert the attached tiny .sfd file
into an SVG font, using the command line

  fontforge -lang=ff -c 'Open($1); Generate($2);' test.sfd test.svg

then fontforge terminates with a segfault, having opened test.svg
for writing but not written any data to it.

This occurs on a Debian Lenny machine on ordinary Intel x86.

Running it under valgrind reports (after a lot of errors in
PyObject_Free, which appear to be unrelated to the segfault inasmuch
as they also occur in runs of fontforge which complete successfully):

==28251== Jump to the invalid address stated on the next line
==28251==    at 0x3F: ???
==28251==    by 0x43785F8: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x43797AF: WriteSVGFont (in /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42C4FF2: _DoSave (in /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42C6ADB: GenerateScript (in /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42DB993: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E48E5: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E0F2B: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E213D: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E231D: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E261D: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==    by 0x42E287B: (within /usr/lib/fontforge/libfontforge.so.1.0.0)
==28251==  Address 0x3f is not stack'd, malloc'd or (recently) free'd

which looks as if something has either trashed its stack or called
through a corrupted function pointer. I tried debugging it myself,
but was unable to reproduce the problem in a version of fontforge
built with debugging information.

Here are my installed version numbers of packages which are either
listed in fontforge's dependencies or which provide a shared library
listed by 'ldd fontforge':

fontforge                   0.0.20080429-1
libc6                       2.7-18
libfreetype6                2.3.7-2+lenny1
libgif4                     4.1.6-6
libice6                     2:1.0.4-1
libjpeg62                   6b-14
libpng12-0                  1.2.27-2+lenny2
libsm6                      2:1.0.3-2
libspiro0                   20071029-2
libtiff4                    3.8.2-11.2
libuninameslist0            0.0.20060907-2
libx11-6                    2:1.1.5-2
libxau6                     1:1.0.3-3
libxcb-xlib0                1.1-1.2
libxcb1                     1.1-1.2
libxdmcp6                   1:1.0.2-3
libxml2                     2.6.32.dfsg-5+lenny1
python2.5                   2.5.2-15
zlib1g                      1:1.2.3.3.dfsg-12

Cheers,
Simon
-- 
Simon Tatham         These are my opinions. There are many
<anakin at pobox.com>   like them but these ones are mine.
-------------- next part --------------
SplineFontDB: 3.0
FontName: Test
FullName: Test
FamilyName: Test
Weight: Medium
Copyright: No copyright is claimed on the outline data of this font.
Version: 0.1.8680
ItalicAngle: 0
UnderlinePosition: -100
UnderlineWidth: 50
Ascent: 800
Descent: 200
LayerCount: 2
Layer: 0 0 "Back" 1
Layer: 1 0 "Fore" 0
UseXUID: 0
OS2Version: 0
OS2_WeightWidthSlopeOnly: 0
OS2_UseTypoMetrics: 1
CreationTime: 1252826347
ModificationTime: 1254912472
OS2TypoAscent: 0
OS2TypoAOffset: 1
OS2TypoDescent: 0
OS2TypoDOffset: 1
OS2TypoLinegap: 0
OS2WinAscent: 0
OS2WinAOffset: 1
OS2WinDescent: 0
OS2WinDOffset: 1
HheadAscent: 0
HheadAOffset: 1
HheadDescent: 0
HheadDOffset: 1
OS2Vendor: 'PfEd'
DEI: 0
Encoding: UnicodeBmp
UnicodeInterp: none
NameList: Adobe Glyph List
DisplaySize: -96
AntiAlias: 1
FitToEm: 1
WinInfo: 64 8 2
BeginChars: 65537 150

StartChar: test
Encoding: 65 65 6
Width: 212.211
Flags: 
LayerCount: 2
Fore
SplineSet
102.411 268.247 m 1
 100.184 267.158 98.8579 265.074 98.6211 262.137 c 0
 98.5842 261.707 98.5609 261.319 98.5609 260.954 c 0
 98.5609 258.505 99.6128 257.121 104.684 251.432 c 0
 116.581 238.021 122.633 226.147 122.633 216.248 c 0
 122.633 213.14 122.037 210.226 120.837 207.521 c 0
 114.916 194.163 99.4263 173.368 81.8526 155.132 c 0
 55.7457 128.018 43.2934 104.692 43.2934 82.1254 c 0
 43.2934 76.0305 44.2018 69.9911 45.9947 63.9474 c 0
 50.4 49.0263 66.6474 27.8526 95.3053 -0.331579 c 0
 100.685 -5.58499 103.766 -7.85098 106.533 -7.85098 c 0
 107.932 -7.85098 109.252 -7.27129 110.747 -6.20526 c 0
 112.838 -4.72009 113.905 -3.0898 113.905 -1.09155 c 0
 113.905 1.75386 111.742 5.34535 107.289 10.3263 c 0
 95.5758 23.5178 89.5937 35.3929 89.5937 45.263 c 0
 89.5937 48.3646 90.1844 51.2683 91.3737 53.9526 c 0
 97.2947 67.3105 112.784 88.1053 130.358 106.342 c 0
 156.647 133.626 167.447 153.474 168.442 176.447 c 0
 168.514 178.025 168.553 179.552 168.553 181.038 c 0
 168.553 201.964 160.883 214.874 131.163 247.026 c 0
 115.472 264.003 110.012 269.119 105.653 269.119 c 0
 104.551 269.119 103.519 268.792 102.411 268.247 c 0
EndSplineSet
EndChar

EndChars
EndSplineFont