[Pkg-fonts-devel] Bug#912062: fontforge: segfaults when opening some UFO fonts

Bernhard Übelacker bernhardu at mailbox.org
Sun Oct 28 22:47:27 GMT 2018


Dear Maintainer,
I just tried to have a look at this segfault.


#0  SPLFindOrder (ss=0x4040000000000000) at ././fontforge/svg.c:3453
#1  0x00007f1eba8d03fe in SFLFindOrder (sf=sf at entry=0x55fdba893010, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
#2  0x00007f1eba90eaa1 in SFReadUFO (basedir=basedir at entry=0x55fdba838090 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo", flags=flags at entry=0) at ././fontforge/ufo.c:4221
#3  0x00007f1eba84bfb0 in _ReadSplineFont (file=0x55fdba869e00, file at entry=0x0, filename=<optimized out>, filename at entry=0x55fdba806780 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1086
#4  0x00007f1eba84ca9c in ReadSplineFont (filename=filename at entry=0x55fdba806780 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1288
#5  0x00007f1eba84cc30 in LoadSplineFont (filename=<optimized out>, openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1346
#6  0x00007f1eba70639c in ViewPostScriptFont (filename=<optimized out>, openflags=0) at ././fontforge/fontviewbase.c:1341
#7  0x00007f1ebb6af023 in fontforge_main (argc=2, argv=0x7ffff1f881f8) at ././fontforgeexe/startui.c:1353
#8  0x00007f1eb9e98b17 in __libc_start_main (main=0x55fdb8a527b0 <main>, argc=2, argv=0x7ffff1f881f8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffff1f881e8) at ../csu/libc-start.c:310
#9  0x000055fdb8a527ea in _start ()


Breakpoint 2, SFLFindOrder (sf=sf at entry=0x5555559ec050, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
3492            ret = SPLFindOrder(sf->glyphs[i]->layers[layerdest].splines);
1: i = 0
2: sf->layer_cnt = 3
3: sf->glyphs[i].layer_cnt = 2
4: layerdest = 2


As far as I found out we do access here "sf->glyphs[i]->layers[layerdest]"
with layerdest==2, but unfortunately "sf->glyphs[i]->layers" got just
allocated with 2 elements. Therefore some unrelated memory behind is
accessed.

I think this is caused by sf (SplineFont) has a layer_cnt of 3 for some
reason, but the glyph (SplineChar) has just a layer_cnt of 2.
Unfortunately the parameter layerdest we receive from outside seems
based on the fonts layer_cnt.

Attached patch makes the crash not happen, but has in every
case be checked by upstream developers.


Kind regards,
Bernhard



--- fontforge/svg.c.orig        2017-07-30 23:49:01.000000000 +0200
+++ fontforge/svg.c     2018-10-28 23:03:35.534953800 +0100
@@ -3489,6 +3489,8 @@ int SFLFindOrder(SplineFont *sf, int lay
     int i, ret;
 
     for ( i=0; i<sf->glyphcnt; ++i ) if ( sf->glyphs[i]!=NULL ) {
+        if (layerdest >= sf->glyphs[i]->layer_cnt)
+            continue;
        ret = SPLFindOrder(sf->glyphs[i]->layers[layerdest].splines);
        if ( ret!=-1 )
 return( ret );
-------------- next part --------------

apt install mc xserver-xorg lightdm xterm openbox dpkg-dev devscripts systemd-coredump valgrind gdb fontmake fontforge fontforge-dbg libpython2.7-dbg
apt build-dep fontforge

systemctl start lightdm



mkdir fonts-cantarell/orig -p
cd    fonts-cantarell/orig
apt source fonts-cantarell
cd ../..

mkdir fontforge/orig -p
cd    fontforge/orig
apt source fontforge
cd ../..





export DISPLAY=:0
cd fonts-cantarell/orig/fonts-cantarell-0.111
fontmake -g src/Cantarell.glyphs -o ufo
fontforge master_ufo/Cantarell-Regular.ufo/



benutzer at debian:~/fonts-cantarell/orig/fonts-cantarell-0.111$ fontforge master_ufo/Cantarell-Regular.ufo/
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 11:21 UTC 24-Sep-2017-ML-D.
 Based on source from git with hash: 
no xdefs_filename!
TESTING: getPixmapDir:/usr/share/fontforge/pixmaps
TESTING: getShareDir:/usr/share/fontforge
TESTING: GResourceProgramDir:/usr/bin
trying default theme:/usr/share/fontforge/pixmaps/resources
else argv[i]:master_ufo/Cantarell-Regular.ufo/
Speicherzugriffsfehler (Speicherabzug geschrieben)



[  649.073116] traps: fontforge[22506] general protection ip:7f1eba8c55aa sp:7ffff1f85cd0 error:0 in libfontforge.so.2.0.0[7f1eba60c000+3b6000]



root at debian:~# coredumpctl gdb 22506
           PID: 22506 (fontforge)
           UID: 1000 (benutzer)
           GID: 1000 (benutzer)
        Signal: 11 (SEGV)
     Timestamp: Sun 2018-10-28 15:20:45 CET (1min 46s ago)
  Command Line: fontforge master_ufo/Cantarell-Regular.ufo/
    Executable: /usr/bin/fontforge
 Control Group: /user.slice/user-1000.slice/session-3.scope
          Unit: session-3.scope
         Slice: user-1000.slice
       Session: 3
     Owner UID: 1000 (benutzer)
       Boot ID: 800388249e964e8e957a83f4fffe4c1c
    Machine ID: 32f43b50ac8c4b21941bc0b02f8e7811
      Hostname: debian
       Storage: /var/lib/systemd/coredump/core.fontforge.1000.800388249e964e8e957a83f4fffe4c1c.22506.1540736445000000.lz4
       Message: Process 22506 (fontforge) of user 1000 dumped core.
                
                Stack trace of thread 22506:
                #0  0x00007f1eba8c55aa n/a (libfontforge.so.2)
                #1  0x00007f1eba8d03fe SFLFindOrder (libfontforge.so.2)
                #2  0x00007f1eba90eaa1 SFReadUFO (libfontforge.so.2)
                #3  0x00007f1eba84bfb0 _ReadSplineFont (libfontforge.so.2)
                #4  0x00007f1eba84cc30 LoadSplineFont (libfontforge.so.2)
                #5  0x00007f1eba70639c ViewPostScriptFont (libfontforge.so.2)
                #6  0x00007f1ebb6af023 fontforge_main (libfontforgeexe.so.2)
                #7  0x00007f1eb9e98b17 __libc_start_main (libc.so.6)
                #8  0x000055fdb8a527ea _start (fontforge)

GNU gdb (Debian 8.1-4+b1) 8.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/fontforge...(no debugging symbols found)...done.
[New LWP 22506]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `fontforge master_ufo/Cantarell-Regular.ufo/'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f1eba8c55aa in ?? () from /usr/lib/libfontforge.so.2
(gdb) set width 0
(gdb) set pagination off
(gdb) bt
#0  0x00007f1eba8c55aa in ?? () from /usr/lib/libfontforge.so.2
#1  0x00007f1eba8d03fe in SFLFindOrder () from /usr/lib/libfontforge.so.2
#2  0x00007f1eba90eaa1 in SFReadUFO () from /usr/lib/libfontforge.so.2
#3  0x00007f1eba84bfb0 in _ReadSplineFont () from /usr/lib/libfontforge.so.2
#4  0x00007f1eba84cc30 in LoadSplineFont () from /usr/lib/libfontforge.so.2
#5  0x00007f1eba70639c in ViewPostScriptFont () from /usr/lib/libfontforge.so.2
#6  0x00007f1ebb6af023 in fontforge_main () from /usr/lib/libfontforgeexe.so.2
#7  0x00007f1eb9e98b17 in __libc_start_main (main=0x55fdb8a527b0 <main>, argc=2, argv=0x7ffff1f881f8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffff1f881e8) at ../csu/libc-start.c:310
#8  0x000055fdb8a527ea in _start ()


# With debug symbols:
#0  SPLFindOrder (ss=0x4040000000000000) at ././fontforge/svg.c:3453
#1  0x00007f1eba8d03fe in SFLFindOrder (sf=sf at entry=0x55fdba893010, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
#2  0x00007f1eba90eaa1 in SFReadUFO (basedir=basedir at entry=0x55fdba838090 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo", flags=flags at entry=0) at ././fontforge/ufo.c:4221
#3  0x00007f1eba84bfb0 in _ReadSplineFont (file=0x55fdba869e00, file at entry=0x0, filename=<optimized out>, filename at entry=0x55fdba806780 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1086
#4  0x00007f1eba84ca9c in ReadSplineFont (filename=filename at entry=0x55fdba806780 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1288
#5  0x00007f1eba84cc30 in LoadSplineFont (filename=<optimized out>, openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1346
#6  0x00007f1eba70639c in ViewPostScriptFont (filename=<optimized out>, openflags=0) at ././fontforge/fontviewbase.c:1341
#7  0x00007f1ebb6af023 in fontforge_main (argc=2, argv=0x7ffff1f881f8) at ././fontforgeexe/startui.c:1353
#8  0x00007f1eb9e98b17 in __libc_start_main (main=0x55fdb8a527b0 <main>, argc=2, argv=0x7ffff1f881f8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffff1f881e8) at ../csu/libc-start.c:310
#9  0x000055fdb8a527ea in _start ()


(gdb) list svg.c:3448,3461
3448    static int SPLFindOrder(SplineSet *ss) {
3449        Spline *s, *first;
3450
3451        while ( ss!=NULL ) {
3452            first = NULL;
3453            for ( s = ss->first->next; s!=NULL && s!=first ; s = s->to->next ) {
3454                if ( first==NULL ) first = s;
3455                if ( !s->knownlinear )
3456    return( s->order2 );
3457            }
3458            ss = ss->next;
3459        }
3460    return( -1 );
3461    }

(gdb) list svg.c:3488,3497
3488    int SFLFindOrder(SplineFont *sf, int layerdest) {
3489        int i, ret;
3490
3491        for ( i=0; i<sf->glyphcnt; ++i ) if ( sf->glyphs[i]!=NULL ) {
3492            ret = SPLFindOrder(sf->glyphs[i]->layers[layerdest].splines);
3493            if ( ret!=-1 )
3494    return( ret );
3495        }
3496    return( 0 );
3497    }

(gdb) print sf
$1 = (SplineFont *) 0x55fdba893010
(gdb) print sf->glyphs
$2 = (SplineChar **) 0x55fdbacc0af0
(gdb) print i
$3 = <optimized out>
(gdb) print sf->glyphs[0]
$4 = (SplineChar *) 0x55fdba8a0200
(gdb) print sf->glyphs[0]->layers
$5 = (Layer *) 0x55fdba8a0350
(gdb) print layerdest
$6 = 2
(gdb) print sf->glyphs[0]->layers[layerdest].splines
$8 = (SplinePointList *) 0x0
(gdb) print sf->glyphs[1]->layers[layerdest].splines
$10 = (SplinePointList *) 0x4040000000000000






############





benutzer at debian:~/fonts-cantarell/orig/fonts-cantarell-0.111$ valgrind --vgdb=yes --vgdb-error=0 /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
==23308== Memcheck, a memory error detector
==23308== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==23308== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==23308== Command: /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
==23308== 
==23308== (action at startup) vgdb me ... 
==23308== 
==23308== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==23308==   /path/to/gdb /usr/bin/fontforge
==23308== and then give GDB the following command
==23308==   target remote | /usr/lib/valgrind/../../bin/vgdb --pid=23308
==23308== --pid is optional if only one valgrind process is running
==23308== 
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 11:21 UTC 24-Sep-2017-ML-D.
 Based on source from git with hash: 
no xdefs_filename!
TESTING: getPixmapDir:/usr/share/fontforge/pixmaps
TESTING: getShareDir:/usr/share/fontforge
TESTING: GResourceProgramDir:/usr/bin
trying default theme:/usr/share/fontforge/pixmaps/resources
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x876CE8C: tupledealloc.lto_priv.445 (tupleobject.c:235)
==23308==    by 0x87B4A8A: code_dealloc.lto_priv.259 (codeobject.c:349)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==  Address 0xd8dc020 is 1,648 bytes inside a block of size 2,731 free'd
==23308==    at 0x48369EB: free (vg_replace_malloc.c:530)
==23308==    by 0x870059E: PyMarshal_ReadLastObjectFromFile (marshal.c:1156)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308==  Block was alloc'd at
==23308==    at 0x48357BF: malloc (vg_replace_malloc.c:299)
==23308==    by 0x870056B: PyMarshal_ReadLastObjectFromFile (marshal.c:1152)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x87B4AAA: code_dealloc.lto_priv.259 (codeobject.c:347)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308==  Address 0xd934020 is 3,552 bytes inside a block of size 4,096 free'd
==23308==    at 0x48369EB: free (vg_replace_malloc.c:530)
==23308==    by 0x62AF86A: _IO_setb (genops.c:349)
==23308==    by 0x62ADEAB: _IO_file_close_it@@GLIBC_2.2.5 (fileops.c:154)
==23308==    by 0x62A1296: fclose@@GLIBC_2.2.5 (iofclose.c:53)
==23308==    by 0x8702B60: load_source_module (import.c:1117)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==  Block was alloc'd at
==23308==    at 0x48357BF: malloc (vg_replace_malloc.c:299)
==23308==    by 0x62A109B: _IO_file_doallocate (filedoalloc.c:101)
==23308==    by 0x62AF8F8: _IO_doallocbuf (genops.c:365)
==23308==    by 0x62AE943: _IO_file_underflow@@GLIBC_2.2.5 (fileops.c:495)
==23308==    by 0x62AF971: _IO_default_uflow (genops.c:380)
==23308==    by 0x86F5970: UnknownInlinedFun (marshal.c:530)
==23308==    by 0x86F5970: PyMarshal_ReadLongFromFile (marshal.c:1121)
==23308==    by 0x8702B01: UnknownInlinedFun (import.c:818)
==23308==    by 0x8702B01: load_source_module (import.c:1115)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x87B4AAA: code_dealloc.lto_priv.259 (codeobject.c:347)
==23308==    by 0x876CE2B: tupledealloc.lto_priv.445 (tupleobject.c:222)
==23308==    by 0x87B4A9A: code_dealloc.lto_priv.259 (codeobject.c:348)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==  Address 0xd922020 is 144 bytes inside a block of size 848 free'd
==23308==    at 0x48379DF: realloc (vg_replace_malloc.c:785)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:62)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:277)
==23308==    by 0x879BC63: PyList_Append (listobject.c:289)
==23308==    by 0x87000D1: r_object (marshal.c:834)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB6C: r_object (marshal.c:1033)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB58: r_object (marshal.c:1030)
==23308==    by 0x8700497: PyMarshal_ReadObjectFromString (marshal.c:1194)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==  Block was alloc'd at
==23308==    at 0x48379DF: realloc (vg_replace_malloc.c:785)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:62)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:277)
==23308==    by 0x879BC63: PyList_Append (listobject.c:289)
==23308==    by 0x87000D1: r_object (marshal.c:834)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB6C: r_object (marshal.c:1033)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB58: r_object (marshal.c:1030)
==23308==    by 0x8700497: PyMarshal_ReadObjectFromString (marshal.c:1194)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x876CE8C: tupledealloc.lto_priv.445 (tupleobject.c:235)
==23308==    by 0x87B4A9A: code_dealloc.lto_priv.259 (codeobject.c:348)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==  Address 0xd8d0020 is 9,264 bytes inside a block of size 11,385 free'd
==23308==    at 0x48369EB: free (vg_replace_malloc.c:530)
==23308==    by 0x870059E: PyMarshal_ReadLastObjectFromFile (marshal.c:1156)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308==  Block was alloc'd at
==23308==    at 0x48357BF: malloc (vg_replace_malloc.c:299)
==23308==    by 0x870056B: PyMarshal_ReadLastObjectFromFile (marshal.c:1152)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x87B4A00: code_dealloc.lto_priv.259 (codeobject.c:357)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308==  Address 0xd8d3020 is 192 bytes inside a block of size 1,384 free'd
==23308==    at 0x48369EB: free (vg_replace_malloc.c:530)
==23308==    by 0x879C988: list_dealloc.lto_priv.360 (listobject.c:311)
==23308==    by 0x87004B3: PyMarshal_ReadObjectFromString (marshal.c:1195)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==  Block was alloc'd at
==23308==    at 0x48379DF: realloc (vg_replace_malloc.c:785)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:62)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:277)
==23308==    by 0x879BC63: PyList_Append (listobject.c:289)
==23308==    by 0x87000D1: r_object (marshal.c:834)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB80: r_object (marshal.c:1036)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB58: r_object (marshal.c:1030)
==23308==    by 0x8700497: PyMarshal_ReadObjectFromString (marshal.c:1194)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
==23308== Invalid read of size 4
==23308==    at 0x877AA73: PyObject_Free (obmalloc.c:1013)
==23308==    by 0x87B4A2A: code_dealloc.lto_priv.259 (codeobject.c:355)
==23308==    by 0x8702D61: load_source_module (import.c:1144)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==    by 0x8719031: PyEval_EvalCodeEx (ceval.c:3604)
==23308==    by 0x8719648: PyEval_EvalCode (ceval.c:669)
==23308==  Address 0xda38020 is 1,024 bytes inside a block of size 4,784 free'd
==23308==    at 0x48369EB: free (vg_replace_malloc.c:530)
==23308==    by 0x879C988: list_dealloc.lto_priv.360 (listobject.c:311)
==23308==    by 0x87004B3: PyMarshal_ReadObjectFromString (marshal.c:1195)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308==    by 0x87C9E12: PyObject_Call (abstract.c:2544)
==23308==    by 0x87186C6: PyEval_CallObjectWithKeywords (ceval.c:4241)
==23308==    by 0x871CCC1: PyEval_EvalFrameEx (ceval.c:2643)
==23308==  Block was alloc'd at
==23308==    at 0x48379DF: realloc (vg_replace_malloc.c:785)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:62)
==23308==    by 0x879BC63: UnknownInlinedFun (listobject.c:277)
==23308==    by 0x879BC63: PyList_Append (listobject.c:289)
==23308==    by 0x87000D1: r_object (marshal.c:834)
==23308==    by 0x86FF2CA: r_object (marshal.c:897)
==23308==    by 0x86FFB58: r_object (marshal.c:1030)
==23308==    by 0x8700497: PyMarshal_ReadObjectFromString (marshal.c:1194)
==23308==    by 0x8700591: PyMarshal_ReadLastObjectFromFile (marshal.c:1155)
==23308==    by 0x8702B3B: UnknownInlinedFun (import.c:845)
==23308==    by 0x8702B3B: load_source_module (import.c:1116)
==23308==    by 0x8704480: import_submodule (import.c:2747)
==23308==    by 0x8704947: load_next (import.c:2561)
==23308==    by 0x87057B4: UnknownInlinedFun (import.c:2269)
==23308==    by 0x87057B4: PyImport_ImportModuleLevel (import.c:2334)
==23308==    by 0x8728247: builtin___import__.lto_priv.1716 (bltinmodule.c:49)
==23308== 
==23308== (action on error) vgdb me ... 
==23308== Continuing ...
else argv[i]:master_ufo/Cantarell-Regular.ufo/
==23308== Invalid read of size 8
==23308==    at 0x58DD3F4: SFLFindOrder (svg.c:3492)
==23308==    by 0x591BAA0: SFReadUFO (ufo.c:4221)
==23308==    by 0x5858FAF: _ReadSplineFont (splinefont.c:1086)
==23308==    by 0x5859C2F: LoadSplineFont (splinefont.c:1346)
==23308==    by 0x571339B: ViewPostScriptFont (fontviewbase.c:1341)
==23308==    by 0x4A12022: fontforge_main (startui.c:1353)
==23308==    by 0x6255B16: (below main) (libc-start.c:310)
==23308==  Address 0xe8f7748 is 24 bytes after a block of size 16 in arena "client"
==23308== 
==23308== (action on error) vgdb me ... 




benutzer at debian:~$ gdb -q /usr/bin/fontforge
Reading symbols from /usr/bin/fontforge...Reading symbols from /usr/lib/debug/.build-id/8b/3360bec72ac1753c161330a0cf4f5ff6f8f3b1.debug...done.
done.
(gdb) set width 0
(gdb) set pagination off
(gdb) directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
Source directories searched: /home/benutzer/fontforge/orig/fontforge-20170731~dfsg:$cdir:$cwd
(gdb) target remote | vgdb
Remote debugging using | vgdb
relaying data between gdb and process 23308
warning: remote target does not support file transfer, attempting to access files from local filesystem.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/.build-id/dc/5cb16f5e644116cac64a4c3f5da4d081b81a4f.debug...done.
done.
0x0000000004001210 in _start () from /lib64/ld-linux-x86-64.so.2
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8dcb70) at ../Objects/obmalloc.c:1013
1013    ../Objects/obmalloc.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  PyObject_Free (p=0xd8dcb70) at ../Objects/obmalloc.c:1013
#1  0x000000000876ce8d in tupledealloc (op=0xd8dcb90) at ../Objects/tupleobject.c:235
#2  0x00000000087b4a8b in code_dealloc (co=0xdbd6430) at ../Objects/codeobject.c:349
#3  0x0000000008702d62 in load_source_module (name=<optimized out>, pathname=<optimized out>, fp=<optimized out>) at ../Python/import.c:1144
#4  0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd8d5c00 "stat", fullname=fullname at entry=0xd8d5c00 "stat") at ../Python/import.c:2747
#5  0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffd110, buf=buf at entry=0xd8d5c00 "stat", p_buflen=p_buflen at entry=0x1ffeffd118) at ../Python/import.c:2561
#6  0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#7  PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#8  0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#9  0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('stat', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#10 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('stat', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#11 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#12 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#13 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#14 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd8c7e40 "posixpath", co=co at entry=<code at remote 0xdbc1eb0>, pathname=pathname at entry=0xd8cb8f0 "/usr/lib/python2.7/posixpath.pyc") at ../Python/import.c:753
#15 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8cb8f0 "/usr/lib/python2.7/posixpath.pyc", fp=<optimized out>) at ../Python/import.c:1143
#16 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd8c7e40 "posixpath", fullname=fullname at entry=0xd8c7e40 "posixpath") at ../Python/import.c:2747
#17 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffd640, buf=buf at entry=0xd8c7e40 "posixpath", p_buflen=p_buflen at entry=0x1ffeffd648) at ../Python/import.c:2561
#18 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#19 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#20 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#21 0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('posixpath', {'WTERMSIG': <built-in function WTERMSIG>, 'lseek': <built-in function lseek>, 'EX_IOERR': 74, 'EX_NOHOST': 68, 'seteuid': <built-in function seteuid>, 'major': <built-in function major>, 'fstatvfs': <built-in function fstatvfs>, 'uname': <built-in function uname>, 'kill': <built-in function kill>, 'urandom': <built-in function urandom>, 'ST_RELATIME': 4096, 'getegid': <built-in function getegid>, 'getresgid': <built-in function getresgid>, 'EX_OSFILE': 72, 'umask': <built-in function umask>, 'linesep': '\n', 'ST_NODIRATIME': 2048, 'fchmod': <built-in function fchmod>, 'lchown': <built-in function lchown>, 'setgid': <built-in function setgid>, 'tmpnam': <built-in function tmpnam>, 'EX_NOINPUT': 66, 'makedev': <built-in function makedev>, 'fstat': <built-in function fstat>, 'getlogin': <built-in function getlogin>, 'EX_TEMPFAIL': 75, 'O_CREAT': 64, 'dup2': <built-in function dup2>, 'read': <built-in function read>, '__file__': '/usr/lib/python2.7/os.pyc', 'getppid': <built-in function getppid>, '...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#22 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('posixpath', {'WTERMSIG': <built-in function WTERMSIG>, 'lseek': <built-in function lseek>, 'EX_IOERR': 74, 'EX_NOHOST': 68, 'seteuid': <built-in function seteuid>, 'major': <built-in function major>, 'fstatvfs': <built-in function fstatvfs>, 'uname': <built-in function uname>, 'kill': <built-in function kill>, 'urandom': <built-in function urandom>, 'ST_RELATIME': 4096, 'getegid': <built-in function getegid>, 'getresgid': <built-in function getresgid>, 'EX_OSFILE': 72, 'umask': <built-in function umask>, 'linesep': '\n', 'ST_NODIRATIME': 2048, 'fchmod': <built-in function fchmod>, 'lchown': <built-in function lchown>, 'setgid': <built-in function setgid>, 'tmpnam': <built-in function tmpnam>, 'EX_NOINPUT': 66, 'makedev': <built-in function makedev>, 'fstat': <built-in function fstat>, 'getlogin': <built-in function getlogin>, 'EX_TEMPFAIL': 75, 'O_CREAT': 64, 'dup2': <built-in function dup2>, 'read': <built-in function read>, '__file__': '/usr/lib/python2.7/os.pyc', 'getppid': <built-in function getppid>, '...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#23 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#24 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#25 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#26 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd88f620 "os", co=co at entry=<code at remote 0xdbc1230>, pathname=pathname at entry=0xd8930d0 "/usr/lib/python2.7/os.pyc") at ../Python/import.c:753
#27 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8930d0 "/usr/lib/python2.7/os.pyc", fp=<optimized out>) at ../Python/import.c:1143
#28 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd88f620 "os", fullname=fullname at entry=0xd88f620 "os") at ../Python/import.c:2747
#29 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffdb70, buf=buf at entry=0xd88f620 "os", p_buflen=p_buflen at entry=0x1ffeffdb78) at ../Python/import.c:2561
#30 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#31 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#32 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#33 0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('os', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '__...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#34 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('os', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '__...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#35 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#36 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#37 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#38 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd87ff40 "site", co=co at entry=<code at remote 0xdbaf5b0>, pathname=pathname at entry=0xd8839f0 "/usr/lib/python2.7/site.pyc") at ../Python/import.c:753
#39 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8839f0 "/usr/lib/python2.7/site.pyc", fp=<optimized out>) at ../Python/import.c:1143
#40 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd87ff40 "site", fullname=fullname at entry=0xd87ff40 "site") at ../Python/import.c:2747
#41 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffe0a0, buf=buf at entry=0xd87ff40 "site", p_buflen=p_buflen at entry=0x1ffeffe0a8) at ../Python/import.c:2561
#42 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=['__doc__'], globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#43 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#44 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#45 0x00000000087c9e13 in PyObject_Call (func=func at entry=<built-in function __import__>, arg=arg at entry=('site', {'__builtins__': <module at remote 0xdb4db08>}, {...}, ['__doc__'], 0), kw=kw at entry=0x0) at ../Objects/abstract.c:2544
#46 0x00000000087ca8c7 in call_function_tail (args=('site', {'__builtins__': <module at remote 0xdb4db08>}, {...}, ['__doc__'], 0), callable=<built-in function __import__>) at ../Objects/abstract.c:2600
#47 PyObject_CallFunction (callable=<built-in function __import__>, format=<optimized out>) at ../Objects/abstract.c:2600
#48 0x0000000008705dea in PyImport_Import (module_name=module_name at entry='site') at ../Python/import.c:2933
#49 0x0000000008705f8a in PyImport_ImportModule (name=<optimized out>) at ../Python/import.c:2173
#50 0x00000000086f4a1c in initsite () at ../Python/pythonrun.c:735
#51 Py_InitializeEx (install_sigs=<optimized out>, install_sigs=<optimized out>) at ../Python/pythonrun.c:291
#52 0x00000000086f519a in Py_Initialize () at ../Python/pythonrun.c:388
#53 0x00000000057e5dba in FontForge_InitializeEmbeddedPython () at ././fontforge/python.c:18611
#54 0x0000000004a11024 in fontforge_main (argc=2, argv=0x1fff000518) at ././fontforgeexe/startui.c:1200
#55 0x0000000006255b17 in __libc_start_main (main=0x1087b0 <main>, argc=2, argv=0x1fff000518, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x1fff000508) at ../csu/libc-start.c:310
#56 0x00000000001087ea in _start ()
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/posixpath.py", line 15, in <module>
    import stat
  File "/usr/lib/python2.7/os.py", line 49, in <module>
    import posixpath as path
  File "/usr/lib/python2.7/site.py", line 68, in <module>
    import os
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd934d60) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) bt
#0  PyObject_Free (p=0xd934d60) at ../Objects/obmalloc.c:1013
#1  0x00000000087b4aab in code_dealloc (co=0xdbdbdb0) at ../Objects/codeobject.c:347
#2  0x0000000008702d62 in load_source_module (name=<optimized out>, pathname=<optimized out>, fp=<optimized out>) at ../Python/import.c:1144
#3  0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd92e4d0 "types", fullname=fullname at entry=0xd92e4d0 "types") at ../Python/import.c:2747
#4  0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffcbe0, buf=buf at entry=0xd92e4d0 "types", p_buflen=p_buflen at entry=0x1ffeffcbe8) at ../Python/import.c:2561
#5  0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#6  PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#7  0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#8  0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('types', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, ...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#9  0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('types', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, ...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#10 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#11 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#12 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#13 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd917cf0 "warnings", co=co at entry=<code at remote 0xdbdb730>, pathname=pathname at entry=0xd91b7a0 "/usr/lib/python2.7/warnings.pyc") at ../Python/import.c:753
#14 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd91b7a0 "/usr/lib/python2.7/warnings.pyc", fp=<optimized out>) at ../Python/import.c:1143
#15 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd917cf0 "warnings", fullname=fullname at entry=0xd917cf0 "warnings") at ../Python/import.c:2747
#16 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffd110, buf=buf at entry=0xd917cf0 "warnings", p_buflen=p_buflen at entry=0x1ffeffd118) at ../Python/import.c:2561
#17 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#18 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#19 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#20 0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('warnings', {'genericpath': <module at remote 0xdbd7050>, 'stat': <module at remote 0xdbc8e88>, '__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in functio...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#21 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('warnings', {'genericpath': <module at remote 0xdbd7050>, 'stat': <module at remote 0xdbc8e88>, '__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in functio...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#22 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#23 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#24 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#25 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd8c7e40 "posixpath", co=co at entry=<code at remote 0xdbc1eb0>, pathname=pathname at entry=0xd8cb8f0 "/usr/lib/python2.7/posixpath.pyc") at ../Python/import.c:753
#26 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8cb8f0 "/usr/lib/python2.7/posixpath.pyc", fp=<optimized out>) at ../Python/import.c:1143
#27 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd8c7e40 "posixpath", fullname=fullname at entry=0xd8c7e40 "posixpath") at ../Python/import.c:2747
#28 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffd640, buf=buf at entry=0xd8c7e40 "posixpath", p_buflen=p_buflen at entry=0x1ffeffd648) at ../Python/import.c:2561
#29 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#30 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#31 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#32 0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('posixpath', {'WTERMSIG': <built-in function WTERMSIG>, 'lseek': <built-in function lseek>, 'EX_IOERR': 74, 'EX_NOHOST': 68, 'seteuid': <built-in function seteuid>, 'major': <built-in function major>, 'fstatvfs': <built-in function fstatvfs>, 'uname': <built-in function uname>, 'kill': <built-in function kill>, 'urandom': <built-in function urandom>, 'ST_RELATIME': 4096, 'getegid': <built-in function getegid>, 'getresgid': <built-in function getresgid>, 'EX_OSFILE': 72, 'umask': <built-in function umask>, 'linesep': '\n', 'ST_NODIRATIME': 2048, 'fchmod': <built-in function fchmod>, 'lchown': <built-in function lchown>, 'setgid': <built-in function setgid>, 'tmpnam': <built-in function tmpnam>, 'EX_NOINPUT': 66, 'makedev': <built-in function makedev>, 'fstat': <built-in function fstat>, 'getlogin': <built-in function getlogin>, 'EX_TEMPFAIL': 75, 'O_CREAT': 64, 'dup2': <built-in function dup2>, 'read': <built-in function read>, '__file__': '/usr/lib/python2.7/os.pyc', 'getppid': <built-in function getppid>, '...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#33 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('posixpath', {'WTERMSIG': <built-in function WTERMSIG>, 'lseek': <built-in function lseek>, 'EX_IOERR': 74, 'EX_NOHOST': 68, 'seteuid': <built-in function seteuid>, 'major': <built-in function major>, 'fstatvfs': <built-in function fstatvfs>, 'uname': <built-in function uname>, 'kill': <built-in function kill>, 'urandom': <built-in function urandom>, 'ST_RELATIME': 4096, 'getegid': <built-in function getegid>, 'getresgid': <built-in function getresgid>, 'EX_OSFILE': 72, 'umask': <built-in function umask>, 'linesep': '\n', 'ST_NODIRATIME': 2048, 'fchmod': <built-in function fchmod>, 'lchown': <built-in function lchown>, 'setgid': <built-in function setgid>, 'tmpnam': <built-in function tmpnam>, 'EX_NOINPUT': 66, 'makedev': <built-in function makedev>, 'fstat': <built-in function fstat>, 'getlogin': <built-in function getlogin>, 'EX_TEMPFAIL': 75, 'O_CREAT': 64, 'dup2': <built-in function dup2>, 'read': <built-in function read>, '__file__': '/usr/lib/python2.7/os.pyc', 'getppid': <built-in function getppid>, '...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#34 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#35 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#36 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#37 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd88f620 "os", co=co at entry=<code at remote 0xdbc1230>, pathname=pathname at entry=0xd8930d0 "/usr/lib/python2.7/os.pyc") at ../Python/import.c:753
#38 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8930d0 "/usr/lib/python2.7/os.pyc", fp=<optimized out>) at ../Python/import.c:1143
#39 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd88f620 "os", fullname=fullname at entry=0xd88f620 "os") at ../Python/import.c:2747
#40 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffdb70, buf=buf at entry=0xd88f620 "os", p_buflen=p_buflen at entry=0x1ffeffdb78) at ../Python/import.c:2561
#41 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=None, globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#42 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#43 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#44 0x00000000087c9e13 in PyObject_Call (func=<built-in function __import__>, arg=('os', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '__...(truncated), kw=0x0) at ../Objects/abstract.c:2544
#45 0x00000000087186c7 in PyEval_CallObjectWithKeywords (func=<built-in function __import__>, arg=('os', {'__builtins__': {'bytearray': <type at remote 0x890aa60>, 'IndexError': <type at remote 0x8933d60>, 'all': <built-in function all>, 'vars': <built-in function vars>, 'SyntaxError': <type at remote 0x8904360>, 'unicode': <type at remote 0x890e420>, 'UnicodeDecodeError': <type at remote 0x8948be0>, 'memoryview': <type at remote 0x89074a0>, 'isinstance': <built-in function isinstance>, 'NameError': <type at remote 0x894c340>, 'BytesWarning': <type at remote 0x894d7c0>, 'dict': <type at remote 0x890cba0>, 'input': <built-in function input>, 'oct': <built-in function oct>, 'bin': <built-in function bin>, 'SystemExit': <type at remote 0x89127a0>, 'StandardError': <type at remote 0x8903f00>, 'format': <built-in function format>, 'repr': <built-in function repr>, 'sorted': <built-in function sorted>, 'False': False, 'RuntimeWarning': <type at remote 0x891df00>, 'list': <type at remote 0x890cd40>, 'iter': <built-in function iter>, 'reload': <built-in function reload>, 'Warning': <type at remote 0x88fe1a0>, '__...(truncated), kw=<optimized out>) at ../Python/ceval.c:4241
#46 0x000000000871ccc2 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:2643
#47 0x0000000008719032 in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, defs=0x0, defcount=0, closure=0x0) at ../Python/ceval.c:3604
#48 0x0000000008719649 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at ../Python/ceval.c:669
#49 0x0000000008702672 in PyImport_ExecCodeModuleEx (name=name at entry=0xd87ff40 "site", co=co at entry=<code at remote 0xdbaf5b0>, pathname=pathname at entry=0xd8839f0 "/usr/lib/python2.7/site.pyc") at ../Python/import.c:753
#50 0x0000000008702d4e in load_source_module (name=<optimized out>, pathname=0xd8839f0 "/usr/lib/python2.7/site.pyc", fp=<optimized out>) at ../Python/import.c:1143
#51 0x0000000008704481 in import_submodule (mod=mod at entry=None, subname=subname at entry=0xd87ff40 "site", fullname=fullname at entry=0xd87ff40 "site") at ../Python/import.c:2747
#52 0x0000000008704948 in load_next (mod=mod at entry=None, altmod=None, p_name=p_name at entry=0x1ffeffe0a0, buf=buf at entry=0xd87ff40 "site", p_buflen=p_buflen at entry=0x1ffeffe0a8) at ../Python/import.c:2561
#53 0x00000000087057b5 in import_module_level (locals=<optimized out>, level=<optimized out>, fromlist=['__doc__'], globals=<optimized out>, name=<optimized out>) at ../Python/import.c:2269
#54 PyImport_ImportModuleLevel (name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>, name=<optimized out>, globals=<optimized out>, locals=<optimized out>, fromlist=<optimized out>, level=<optimized out>) at ../Python/import.c:2334
#55 0x0000000008728248 in builtin___import__ (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../Python/bltinmodule.c:49
#56 0x00000000087c9e13 in PyObject_Call (func=func at entry=<built-in function __import__>, arg=arg at entry=('site', {'__builtins__': <module at remote 0xdb4db08>}, {...}, ['__doc__'], 0), kw=kw at entry=0x0) at ../Objects/abstract.c:2544
#57 0x00000000087ca8c7 in call_function_tail (args=('site', {'__builtins__': <module at remote 0xdb4db08>}, {...}, ['__doc__'], 0), callable=<built-in function __import__>) at ../Objects/abstract.c:2600
#58 PyObject_CallFunction (callable=<built-in function __import__>, format=<optimized out>) at ../Objects/abstract.c:2600
#59 0x0000000008705dea in PyImport_Import (module_name=module_name at entry='site') at ../Python/import.c:2933
#60 0x0000000008705f8a in PyImport_ImportModule (name=<optimized out>) at ../Python/import.c:2173
#61 0x00000000086f4a1c in initsite () at ../Python/pythonrun.c:735
#62 Py_InitializeEx (install_sigs=<optimized out>, install_sigs=<optimized out>) at ../Python/pythonrun.c:291
#63 0x00000000086f519a in Py_Initialize () at ../Python/pythonrun.c:388
#64 0x00000000057e5dba in FontForge_InitializeEmbeddedPython () at ././fontforge/python.c:18611
#65 0x0000000004a11024 in fontforge_main (argc=2, argv=0x1fff000518) at ././fontforgeexe/startui.c:1200
#66 0x0000000006255b17 in __libc_start_main (main=0x1087b0 <main>, argc=2, argv=0x1fff000518, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x1fff000508) at ../csu/libc-start.c:310
#67 0x00000000001087ea in _start ()
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/warnings.py", line 8, in <module>
    import types
  File "/usr/lib/python2.7/posixpath.py", line 17, in <module>
    import warnings
  File "/usr/lib/python2.7/os.py", line 49, in <module>
    import posixpath as path
  File "/usr/lib/python2.7/site.py", line 68, in <module>
    import os
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd922750) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/posixpath.py", line 17, in <module>
    import warnings
  File "/usr/lib/python2.7/os.py", line 49, in <module>
    import posixpath as path
  File "/usr/lib/python2.7/site.py", line 68, in <module>
    import os
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8d0b10) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/os.py", line 49, in <module>
    import posixpath as path
  File "/usr/lib/python2.7/site.py", line 68, in <module>
    import os
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8d3510) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/os.py", line 49, in <module>
    import posixpath as path
  File "/usr/lib/python2.7/site.py", line 68, in <module>
    import os
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xda38f10) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) py-bt
Traceback (most recent call first):
  File "/usr/lib/python2.7/_sysconfigdata.py", line 6, in <module>
    from _sysconfigdata_nd import *
  File "/usr/lib/python2.7/sysconfig.py", line 417, in _init_posix
    from _sysconfigdata import build_time_vars
  File "/usr/lib/python2.7/sysconfig.py", line 533, in get_config_vars
    _init_posix(_CONFIG_VARS)
  File "/usr/lib/python2.7/sysconfig.py", line 587, in get_config_var
    return get_config_vars().get(name)
  File "/usr/lib/python2.7/site.py", line 237, in getuserbase
    USER_BASE = get_config_var('userbase')
  File "/usr/lib/python2.7/site.py", line 247, in getusersitepackages
    user_base = getuserbase() # this will also set USER_BASE
  File "/usr/lib/python2.7/site.py", line 272, in addusersitepackages
    user_site = getusersitepackages()
  File "/usr/lib/python2.7/site.py", line 536, in main
    known_paths = addusersitepackages(known_paths)
  File "/usr/lib/python2.7/site.py", line 554, in <module>
    main()
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00000000058dd3f4 in SFLFindOrder (sf=sf at entry=0xe6ac3e0, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
3492            ret = SPLFindOrder(sf->glyphs[i]->layers[layerdest].splines);
(gdb) py-bt
Unable to locate python frame
(gdb) print sf->glyphs[i]->layers[layerdest].splines
value has been optimized out
(gdb) print sf->glyphs[0]->layers[layerdest].splines
$1 = (SplinePointList *) 0x0
(gdb) print sf->glyphs[1]->layers[layerdest].splines
$2 = (SplinePointList *) 0x50




valgrind --vgdb=yes --vgdb-error=0 /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

gdb -q /usr/bin/fontforge



set width 0
set pagination off
directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
target remote | vgdb



#####################




benutzer at debian:~/fonts-cantarell/orig/fonts-cantarell-0.111$ gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
Reading symbols from /usr/bin/fontforge...Reading symbols from /usr/lib/debug/.build-id/8b/3360bec72ac1753c161330a0cf4f5ff6f8f3b1.debug...done.
done.
(gdb) set width 0
(gdb) set pagination off
(gdb) directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
Source directories searched: /home/benutzer/fontforge/orig/fontforge-20170731~dfsg:$cdir:$cwd
(gdb) b UFOLoadGlyphs
Function "UFOLoadGlyphs" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (UFOLoadGlyphs) pending.
(gdb) run
Starting program: /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 11:21 UTC 24-Sep-2017-ML-D.
 Based on source from git with hash: 
no xdefs_filename!
TESTING: getPixmapDir:/usr/share/fontforge/pixmaps
TESTING: getShareDir:/usr/share/fontforge
TESTING: GResourceProgramDir:/usr/bin
trying default theme:/usr/share/fontforge/pixmaps/resources
else argv[i]:master_ufo/Cantarell-Regular.ufo/

Breakpoint 1, UFOLoadGlyphs (sf=sf at entry=0x5555559fbc80, glyphdir=glyphdir at entry=0x5555559f3850 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/glyphs", layerdest=layerdest at entry=1) at ././fontforge/ufo.c:2910
2910    static void UFOLoadGlyphs(SplineFont *sf,char *glyphdir, int layerdest) {
(gdb) display sf
1: sf = (SplineFont *) 0x5555559fbc80
(gdb) display sf->glyphs
2: sf->glyphs = (SplineChar **) 0x0
(gdb) display sf->glyphs[1]->layers
3: sf->glyphs[1]->layers = <error: Cannot access memory at address 0x8>
(gdb) display sf->glyphs[1]->layers[2].splines
4: sf->glyphs[1]->layers[2].splines = <error: Cannot access memory at address 0x8>
(gdb) print sf->glyphs
$1 = (SplineChar **) 0x0
(gdb) print &(sf->glyphs)
$2 = (SplineChar ***) 0x5555559fbcf8
(gdb) watch *0x5555559fbcf8
Hardware watchpoint 2: *0x5555559fbcf8
(gdb) ignore 2 11
Will ignore next 11 crossings of breakpoint 2.
(gdb) cont
Continuing.

Hardware watchpoint 2: *0x5555559fbcf8

Old value = 1440441536
New value = 1440702000
0x00007ffff6eb3e86 in UFOLoadGlyphs (sf=sf at entry=0x5555559fbc80, glyphdir=glyphdir at entry=0x5555559f3850 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/glyphs", layerdest=layerdest at entry=1) at ././fontforge/ufo.c:2964
2964                                                    sf->glyphs = realloc(sf->glyphs,(sf->glyphmax+=100)*sizeof(SplineChar *));
1: sf = (SplineFont *) 0x5555559fbc80
2: sf->glyphs = (SplineChar **) 0x555555df5e30
3: sf->glyphs[1]->layers = (Layer *) 0x555555a0c710
4: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
(gdb) print &(sf->glyphs[1]->layers[2].splines)
$3 = (SplinePointList **) 0x555555a0c8c8
(gdb) x/1xw 0x555555a0c8c8
0x555555a0c8c8: 0x00000000
(gdb) print &(sf->glyphs[1]->layers[2].splines)
$4 = (SplinePointList **) 0x555555a0c8c8
(gdb) watch *(0x555555a0c8c8)
Hardware watchpoint 3: *(0x555555a0c8c8)
(gdb) watch *(0x555555a0c8c8+4)
Hardware watchpoint 4: *(0x555555a0c8c8+4)
(gdb) cont
Continuing.

Hardware watchpoint 4: *(0x555555a0c8c8+4)

Old value = 0
New value = 1077936128
_SplineSetFindBounds (spl=0x555555a0f890, bounds=bounds at entry=0x555555a0c8c8) at ././fontforge/splineutil.c:605
605                 bounds->miny = bounds->maxy = spl->first->me.y;
(gdb) bt
#0  _SplineSetFindBounds (spl=0x555555a0f890, bounds=bounds at entry=0x555555a0c8c8) at ././fontforge/splineutil.c:605
#1  0x00007ffff6e4cccd in RefCharFindBounds (rf=rf at entry=0x555555a0c870) at ././fontforge/splineutil.c:3008
#2  0x00007ffff6e57818 in SCReinstanciateRefChar (sc=sc at entry=0x555555a0c5c0, rf=rf at entry=0x555555a0c870, layer=layer at entry=1) at ././fontforge/splineutil.c:3123
#3  0x00007ffff6eb1b78 in UFORefFixup (sf=sf at entry=0x5555559fbc80, sc=0x555555a0c5c0, layer=layer at entry=1) at ././fontforge/ufo.c:2904
#4  0x00007ffff6eb3c0f in UFOLoadGlyphs (sf=sf at entry=0x5555559fbc80, glyphdir=glyphdir at entry=0x5555559f3850 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/glyphs", layerdest=layerdest at entry=1) at ././fontforge/ufo.c:2977
#5  0x00007ffff6ebba97 in SFReadUFO (basedir=basedir at entry=0x555555958030 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo", flags=flags at entry=0) at ././fontforge/ufo.c:4219
#6  0x00007ffff6df8fb0 in _ReadSplineFont (file=0x5555558c1400, file at entry=0x0, filename=<optimized out>, filename at entry=0x555555811540 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1086
#7  0x00007ffff6df9a9c in ReadSplineFont (filename=filename at entry=0x555555811540 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1288
#8  0x00007ffff6df9c30 in LoadSplineFont (filename=<optimized out>, openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1346
#9  0x00007ffff6cb339c in ViewPostScriptFont (filename=<optimized out>, openflags=0) at ././fontforge/fontviewbase.c:1341
#10 0x00007ffff7c5c023 in fontforge_main (argc=2, argv=0x7fffffffe5c8) at ././fontforgeexe/startui.c:1353
#11 0x00007ffff6445b17 in __libc_start_main (main=0x5555555547b0 <main>, argc=2, argv=0x7fffffffe5c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe5b8) at ../csu/libc-start.c:310
#12 0x00005555555547ea in _start ()

(gdb) list splineutil.c:596,617
596     static void _SplineSetFindBounds(const SplinePointList *spl, DBounds *bounds) {
597         Spline *spline, *first;
598         /* Ignore contours consisting of a single point (used for hinting, anchors */
599         /*  for mark to base, etc. */
600
601         for ( ; spl!=NULL; spl = spl->next ) if ( spl->first->next!=NULL && spl->first->next->to != spl->first ) {
602             first = NULL;
603             if ( bounds->minx==0 && bounds->maxx==0 && bounds->miny==0 && bounds->maxy == 0 ) {
604                 bounds->minx = bounds->maxx = spl->first->me.x;
605                 bounds->miny = bounds->maxy = spl->first->me.y;                                     <<<<<<<<<<<<<<<<<<<<<<<
606             } else {
607                 if ( spl->first->me.x<bounds->minx ) bounds->minx = spl->first->me.x;
608                 if ( spl->first->me.x>bounds->maxx ) bounds->maxx = spl->first->me.x;
609                 if ( spl->first->me.y<bounds->miny ) bounds->miny = spl->first->me.y;
610                 if ( spl->first->me.y>bounds->maxy ) bounds->maxy = spl->first->me.y;
611             }
612             for ( spline = spl->first->next; spline!=NULL && spline!=first; spline=spline->to->next ) {
613                 SplineFindBounds(spline,bounds);
614                 if ( first==NULL ) first = spline;
615             }
616         }
617     }

(gdb) up
#1  0x00007ffff6e4cccd in RefCharFindBounds (rf=rf at entry=0x555555a0c870) at ././fontforge/splineutil.c:3008
3008            _SplineSetFindBounds(rf->layers[i].splines,&rf->bb);
(gdb) print rf
$5 = (RefChar *) 0x555555a0c870

(gdb) list splineutil.c:3000,3022
3000    void RefCharFindBounds(RefChar *rf) {
3001        int i;
3002        SplineChar *rsc = rf->sc;
3003        real extra=0,e;
3004
3005        memset(&rf->bb,'\0',sizeof(rf->bb));
3006        rf->top.y = -1e10;
3007        for ( i=0; i<rf->layer_cnt; ++i ) {
3008            _SplineSetFindBounds(rf->layers[i].splines,&rf->bb);                                     <<<<<<<<<<<<<<<<<<<<<<<
3009            _SplineSetFindTop(rf->layers[i].splines,&rf->top);
3010            int baselayer = RefLayerFindBaseLayerIndex(rf, i);
3011            if ( baselayer >= 0 && rsc->layers[baselayer].dostroke ) {
3012                if ( rf->layers[i].stroke_pen.width!=WIDTH_INHERITED )
3013                    e = rf->layers[i].stroke_pen.width*rf->layers[i].stroke_pen.trans[0];
3014                else
3015                    e = rf->layers[i].stroke_pen.trans[0];
3016                if ( e>extra ) extra = e;
3017            }
3018        }
3019        if ( rf->top.y < -65536 ) rf->top.y = rf->top.x = 0;
3020        rf->bb.minx -= extra; rf->bb.miny -= extra;
3021        rf->bb.maxx += extra; rf->bb.maxy += extra;
3022    }

(gdb) up
#2  0x00007ffff6e57818 in SCReinstanciateRefChar (sc=sc at entry=0x555555a0c5c0, rf=rf at entry=0x555555a0c870, layer=layer at entry=1) at ././fontforge/splineutil.c:3123
3123        RefCharFindBounds(rf);

(gdb) list splineutil.c:3024,3124
3024    void SCReinstanciateRefChar(SplineChar *sc,RefChar *rf,int layer) {
3025        SplinePointList *new, *last;
3026        RefChar *refs;
3027        int i,j;
3028        SplineChar *rsc = rf->sc;
3029        real extra=0,e;
3030
3031        for ( i=0; i<rf->layer_cnt; ++i ) {
3032            SplinePointListsFree(rf->layers[i].splines);
3033            GradientFree(rf->layers[i].fill_brush.gradient);
3034            PatternFree(rf->layers[i].fill_brush.pattern);
3035            GradientFree(rf->layers[i].stroke_pen.brush.gradient);
3036            PatternFree(rf->layers[i].stroke_pen.brush.pattern);
3037        }
3038        free( rf->layers );
3039        rf->layers = NULL;
3040        rf->layer_cnt = 0;
3041        if ( rsc==NULL )
3042    return;
3043        /* Can be called before sc->parent is set, but only when reading a ttf */
3044        /*  file which won't be multilayer */
3045        if ( sc->parent!=NULL && sc->parent->multilayer ) {
3046            int cnt = 0;
3047            RefChar *subref;
3048            for ( i=ly_fore; i<rsc->layer_cnt; ++i ) {
3049                if ( rsc->layers[i].splines!=NULL || rsc->layers[i].images!=NULL )
3050                    ++cnt;
3051                for ( subref=rsc->layers[i].refs; subref!=NULL; subref=subref->next )
3052                    cnt += subref->layer_cnt;
3053            }
3054
3055            rf->layer_cnt = cnt;
3056            rf->layers = calloc(cnt,sizeof(struct reflayer));
3057            cnt = 0;
3058            for ( i=ly_fore; i<rsc->layer_cnt; ++i ) {
3059                if ( rsc->layers[i].splines!=NULL || rsc->layers[i].images!=NULL ) {
3060                    rf->layers[cnt].splines =
3061                            SplinePointListTransform(
3062                             SplinePointListCopy(rsc->layers[i].splines),rf->transform,tpt_AllPoints);
3063                    rf->layers[cnt].images =
3064                            ImageListTransform(
3065                             ImageListCopy(rsc->layers[i].images),rf->transform,true);
3066                    LayerToRefLayer(&rf->layers[cnt],&rsc->layers[i],rf->transform);
3067                    ++cnt;
3068                }
3069                for ( subref=rsc->layers[i].refs; subref!=NULL; subref=subref->next ) {
3070                    for ( j=0; j<subref->layer_cnt; ++j ) if ( subref->layers[j].images!=NULL || subref->layers[j].splines!=NULL ) {
3071                        rf->layers[cnt] = subref->layers[j];
3072                        rf->layers[cnt].splines =
3073                                SplinePointListTransform(
3074                                 SplinePointListCopy(subref->layers[j].splines),rf->transform,tpt_AllPoints);
3075                        rf->layers[cnt].images =
3076                                ImageListTransform(
3077                                 ImageListCopy(subref->layers[j].images),rf->transform,true);
3078                        ++cnt;
3079                    }
3080                }
3081            }
3082
3083            memset(&rf->bb,'\0',sizeof(rf->bb));
3084            rf->top.y = -1e10;
3085            for ( i=0; i<rf->layer_cnt; ++i ) {
3086                _SplineSetFindBounds(rf->layers[i].splines,&rf->bb);
3087                _SplineSetFindTop(rf->layers[i].splines,&rf->top);
3088                int baselayer = RefLayerFindBaseLayerIndex(rf, i);
3089                if ( baselayer >= 0 && rsc->layers[baselayer].dostroke ) {
3090                    if ( rf->layers[i].stroke_pen.width!=WIDTH_INHERITED )
3091                        e = rf->layers[i].stroke_pen.width*rf->layers[i].stroke_pen.trans[0];
3092                    else
3093                        e = rf->layers[i].stroke_pen.trans[0];
3094                    if ( e>extra ) extra = e;
3095                }
3096            }
3097            if ( rf->top.y < -65536 ) rf->top.y = rf->top.x = 0;
3098            rf->bb.minx -= extra; rf->bb.miny -= extra;
3099            rf->bb.maxx += extra; rf->bb.maxy += extra;
3100        } else {
3101            if ( rf->layer_cnt>0 ) {
3102                SplinePointListsFree(rf->layers[0].splines);
3103                rf->layers[0].splines = NULL;
3104            }
3105            rf->layers = calloc(1,sizeof(struct reflayer));
3106            rf->layer_cnt = 1;
3107            rf->layers[0].dofill = true;
3108            new = SplinePointListTransform(SplinePointListCopy(rf->sc->layers[layer].splines),rf->transform,tpt_AllPoints);
3109            rf->layers[0].splines = new;
3110            last = NULL;
3111            if ( new!=NULL )
3112                for ( last = new; last->next!=NULL; last = last->next );
3113            for ( refs = rf->sc->layers[layer].refs; refs!=NULL; refs = refs->next ) {
3114                new = SplinePointListTransform(SplinePointListCopy(refs->layers[0].splines),rf->transform,tpt_AllPoints);
3115                if ( last!=NULL )
3116                    last->next = new;
3117                else
3118                    rf->layers[0].splines = new;
3119                if ( new!=NULL )
3120                    for ( last = new; last->next!=NULL; last = last->next );
3121            }
3122        }
3123        RefCharFindBounds(rf);                                                                    <<<<<<<<<<<<<<<<<<<<<<<
3124    }

(gdb) up
#3  0x00007ffff6eb1b78 in UFORefFixup (sf=sf at entry=0x5555559fbc80, sc=0x555555a0c5c0, layer=layer at entry=1) at ././fontforge/ufo.c:2904
2904                            SCReinstanciateRefChar(sc,r,layer);

(gdb) list ufo.c:2863,2908
2863    static void UFORefFixup(SplineFont *sf, SplineChar *sc, int layer ) {
2864        RefChar *r, *prev;
2865        SplineChar *rsc;
2866
2867        if ( sc==NULL || sc->ticked )
2868                    return;
2869        sc->ticked = true;
2870        prev = NULL;
2871            // For each reference, attempt to locate the real splinechar matching the name stored in the fake splinechar.
2872            // Free the fake splinechar afterwards.
2873        r=sc->layers[layer].refs;
2874        while ( r!=NULL ) {
2875                    if (r->sc->name == NULL || strcmp(r->sc->name, "") == 0) {
2876                            LogError(_("There's a reference to a glyph with no name."));
2877                            prev = r; r = r->next; continue;
2878                    }
2879                    if (r->sc->ticked) {
2880                      // We've already fixed this one.
2881                      prev = r; r = r->next; continue;
2882                    }
2883                    rsc = SFGetChar(sf,-1, r->sc->name);
2884                    if ( rsc==NULL || rsc->name == NULL || strcmp(rsc->name,"") == 0 ) {
2885                            if (rsc != NULL) {
2886                              LogError(_("Invalid glyph for %s when fixing up references."), r->sc->name);
2887                            } else
2888                            LogError(_("Failed to find glyph %s when fixing up references."), r->sc->name);
2889                            SplineCharFree(r->sc); // Delete the fake glyph.
2890                            r->sc = NULL;
2891                            // Elide r from the list and free it.
2892                            if ( prev==NULL ) sc->layers[layer].refs = r->next;
2893                            else prev->next = r->next;
2894                            RefCharFree(r);
2895                            if ( prev==NULL ) r = sc->layers[layer].refs;
2896                            else r = prev->next;
2897                    } else {
2898                            UFORefFixup(sf,rsc, layer);
2899                            if (r->sc->layer_cnt > 0) {
2900                              fprintf(stderr, "Danger!\n");
2901                            }
2902                            SplineCharFree(r->sc);
2903                            r->sc = rsc;
2904                            SCReinstanciateRefChar(sc,r,layer);                                     <<<<<<<<<<<<<<<<<<<<<<<
2905                            prev = r; r = r->next;
2906                    }
2907        }
2908    }






gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

set width 0
set pagination off
directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
b UFOLoadGlyphs
y
run

display sf
display sf->glyphs
display sf->glyphs[1]->layers
display sf->glyphs[1]->layers[2].splines
print sf->glyphs
print &(sf->glyphs)
watch *0x5555559fbcf8
ignore 2 11
cont

print &(sf->glyphs[1]->layers[2].splines)
watch *(0x555555a0c8c8)
watch *(0x555555a0c8c8+4)
cont


#################




benutzer at debian:~/fonts-cantarell/orig/fonts-cantarell-0.111$ gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
Reading symbols from /usr/bin/fontforge...Reading symbols from /usr/lib/debug/.build-id/8b/3360bec72ac1753c161330a0cf4f5ff6f8f3b1.debug...done.
done.
(gdb) set width 0
(gdb) set pagination off
(gdb) directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
Source directories searched: /home/benutzer/fontforge/orig/fontforge-20170731~dfsg:$cdir:$cwd
(gdb) b UFORefFixup
Function "UFORefFixup" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (UFORefFixup) pending.
(gdb) ignore 1 2
Will ignore next 2 crossings of breakpoint 1.
(gdb) run
Starting program: /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 11:21 UTC 24-Sep-2017-ML-D.
 Based on source from git with hash: 
no xdefs_filename!
TESTING: getPixmapDir:/usr/share/fontforge/pixmaps
TESTING: getShareDir:/usr/share/fontforge
TESTING: GResourceProgramDir:/usr/bin
trying default theme:/usr/share/fontforge/pixmaps/resources
else argv[i]:master_ufo/Cantarell-Regular.ufo/

Breakpoint 1, UFORefFixup (sf=sf at entry=0x5555559ebcc0, sc=sc at entry=0x5555559f8f00, layer=layer at entry=1) at ././fontforge/ufo.c:2867
2867        if ( sc==NULL || sc->ticked )
(gdb) display sf->glyphs[1]->layers[2].splines
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
(gdb) display r
2: r = <optimized out>
(gdb) next
UFORefFixup (sf=sf at entry=0x5555559ebcc0, sc=0x5555559ecfe0, layer=layer at entry=1) at ././fontforge/ufo.c:2899
2899                            if (r->sc->layer_cnt > 0) {
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
2: r = (RefChar *) 0x5555559ed290
(gdb) 
2902                            SplineCharFree(r->sc);
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
2: r = (RefChar *) 0x5555559ed290
(gdb) 
2904                            SCReinstanciateRefChar(sc,r,layer);
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
2: r = (RefChar *) 0x5555559ed290
(gdb) 
2903                            r->sc = rsc;
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
2: r = (RefChar *) 0x5555559ed290
(gdb) 
2904                            SCReinstanciateRefChar(sc,r,layer);
1: sf->glyphs[1]->layers[2].splines = (SplinePointList *) 0x0
2: r = (RefChar *) 0x5555559ed290
(gdb) print &(sf->glyphs[1]->layers[2].splines)
$1 = (SplinePointList **) 0x5555559ed2e8
(gdb) print sizeof(RefChar)
$2 = 152
(gdb) print/x 0x5555559ed290 + 152
$3 = 0x5555559ed328
(gdb) print *RefChar      
A syntax error in expression, near `'.
(gdb) print *r
$4 = {checked = 0, selected = 0, point_match = 0, encoded = 0, justtranslated = 0, use_my_metrics = 0, round_translation_to_grid = 1, point_match_out_of_date = 0, adobe_enc = 0, orig_pos = 0, unicode_enc = 0, transform = {1, 0, 0, 1, 0, 0}, layers = 0x5555559ed330, layer_cnt = 1, next = 0x0, bb = {minx = 0, maxx = 0, miny = 0, maxy = 0}, sc = 0x5555559f8f00, top = {x = 0, y = 0}, match_pt_base = 0, match_pt_ref = 0}
(gdb) print sf->glyphs[1]->layers
$5 = (Layer *) 0x5555559ed130
(gdb) print sf->glyphs[1]->layers[3]
$6 = {background = 1, order2 = 0, anyflexes = 0, dofill = 0, dostroke = 0, fillfirst = 0, fill_brush = {col = 8, opacity = 0, pattern = 0x3f800000fffffffe, gradient = 0x0}, stroke_pen = {brush = {col = 0, opacity = 0, pattern = 0x3f800000fffffffe, gradient = 0x0}, linejoin = 0 '\000', linecap = 0 '\000', width = 0, trans = {-0.0078125000000013375, 0, 0, 0}, dashes = "\000\000\000\000\000\000\000"}, splines = 0x0, images = 0x0, refs = 0x0, undoes = 0x81, redoes = 0x65622f656d6f682f, validation_state = 2054452590, old_vs = 1714385509, python_persistent = 0x6e61632d73746e6f, python_persistent_has_lists = 1701994868}
(gdb) print &(sf->glyphs[1]->layers[3])
$7 = (Layer *) 0x5555559ed328
(gdb) print sc->layers[layer].refs
$8 = (RefChar *) 0x5555559ed290
(gdb) print r
$9 = (RefChar *) 0x5555559ed290
(gdb) print *sc->layers[layer].refs
$10 = {checked = 0, selected = 0, point_match = 0, encoded = 0, justtranslated = 0, use_my_metrics = 0, round_translation_to_grid = 1, point_match_out_of_date = 0, adobe_enc = 0, orig_pos = 0, unicode_enc = 0, transform = {1, 0, 0, 1, 0, 0}, layers = 0x5555559ed330, layer_cnt = 1, next = 0x0, bb = {minx = 0, maxx = 0, miny = 0, maxy = 0}, sc = 0x5555559f8f00, top = {x = 0, y = 0}, match_pt_base = 0, match_pt_ref = 0}
(gdb) print r->bb
$11 = {minx = 0, maxx = 0, miny = 0, maxy = 0}
(gdb) print &(r->bb)
$12 = (DBounds *) 0x5555559ed2e8
(gdb) print &(r->bb.miny)
$13 = (double *) 0x5555559ed2f8
(gdb) 
$14 = (double *) 0x5555559ed2f8
(gdb) print &(r->bb.miny)
$15 = (double *) 0x5555559ed2f8
(gdb) print sf->glyphs[1]->layers[2].splines
$16 = (SplinePointList *) 0x0
(gdb) print &(sf->glyphs[1]->layers[2].splines)
$17 = (SplinePointList **) 0x5555559ed2e8
(gdb) print &(r->bb.miny)                      
$18 = (double *) 0x5555559ed2f8
(gdb) kill
Kill the program being debugged? (y or n) y
(gdb) q




gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

set width 0
set pagination off
directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
b UFORefFixup
y
ignore 1 2
run

display sf->glyphs[1]->layers[2].splines
display r

next




###############



gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

set width 0
set pagination off
directory /home/benutzer/fontforge/try1/fontforge-20170731~dfsg



##############


benutzer at debian:~/fonts-cantarell/orig/fonts-cantarell-0.111$ valgrind --track-origins=yes --vgdb=yes --vgdb-error=0 /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/
==2869== Memcheck, a memory error detector
...
==2869== Continuing ...
else argv[i]:master_ufo/Cantarell-Regular.ufo/
==2869== Invalid read of size 8
==2869==    at 0x58DF3F4: SFLFindOrder (svg.c:3492)
==2869==    by 0x591DAA0: SFReadUFO (ufo.c:4221)
==2869==    by 0x585AFAF: _ReadSplineFont (splinefont.c:1086)
==2869==    by 0x585BC2F: LoadSplineFont (splinefont.c:1346)
==2869==    by 0x571539B: ViewPostScriptFont (fontviewbase.c:1341)
==2869==    by 0x4A14022: fontforge_main (startui.c:1353)
==2869==    by 0x6257B16: (below main) (libc-start.c:310)
==2869==  Address 0xe8f6788 is 24 bytes after a block of size 16 in arena "client"
==2869== 
==2869== (action on error) vgdb me ... 




benutzer at debian:~/DrMemory-Linux-2.0.1-2/bin64$ gdb -q /usr/bin/fontforge
Reading symbols from /usr/bin/fontforge...Reading symbols from /usr/lib/debug/.build-id/8b/3360bec72ac1753c161330a0cf4f5ff6f8f3b1.debug...done.
done.
(gdb) set width 0
(gdb) set pagination off
(gdb) directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
Source directories searched: /home/benutzer/fontforge/orig/fontforge-20170731~dfsg:$cdir:$cwd
(gdb) target remote | vgdb
Remote debugging using | vgdb
relaying data between gdb and process 2869
warning: remote target does not support file transfer, attempting to access files from local filesystem.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/.build-id/dc/5cb16f5e644116cac64a4c3f5da4d081b81a4f.debug...done.
done.
0x0000000004001210 in _start () from /lib64/ld-linux-x86-64.so.2
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8dbbc0) at ../Objects/obmalloc.c:1013
1013    ../Objects/obmalloc.c: Datei oder Verzeichnis nicht gefunden.
(gdb) cont
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd933db0) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd9217a0) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8cfb60) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xd8d2560) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
PyObject_Free (p=0xda37f60) at ../Objects/obmalloc.c:1013
1013    in ../Objects/obmalloc.c
(gdb) 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00000000058df3f4 in SFLFindOrder (sf=sf at entry=0xe6ab200, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
3492            ret = SPLFindOrder(sf->glyphs[i]->layers[layerdest].splines);
(gdb) display/i $pc
1: x/i $pc
=> 0x58df3f4 <SFLFindOrder+52>: mov    0x68(%rax,%r9,1),%rdi
(gdb) print $rax
$1 = 244278736
(gdb) print/x $rax
$2 = 0xe8f65d0
(gdb) print/x $r9
$3 = 0x150
(gdb) print/x 0xe8f65d0 + 0x150*1
$4 = 0xe8f6720
(gdb) print/x 0xe8f65d0 + 0x150*1 + 0x68
$5 = 0xe8f6788
(gdb) print/x &(sf->glyphs[i]->layers[layerdest].splines)
value has been optimized out
(gdb) print/x &(sf->glyphs[1]->layers[layerdest].splines)
$6 = 0xe8f6788
(gdb) monitor check_memory defined 0xe8f6788 1
Address 0xE8F6788 len 1 not addressable:
bad address 0xE8F6788
 Address 0xe8f6788 is 24 bytes after a block of size 16 in arena "client"
(gdb) print/x 0xe8f6788-24
$7 = 0xe8f6770
(gdb) monitor check_memory defined 0xe8f6770 1
Address 0xE8F6770 len 1 not addressable:
bad address 0xE8F6770
 Address 0xe8f6770 is 14 bytes after a block of size 2 free'd
==2869==    at 0x48369EB: free (vg_replace_malloc.c:530)
==2869==    by 0x58B9FAE: SplineCharFreeContents (splineutil.c:5882)
==2869==    by 0x58BA0FD: SplineCharFree (splineutil.c:5917)
==2869==    by 0x5913B64: UFORefFixup (ufo.c:2902)
==2869==    by 0x5915C0E: UFOLoadGlyphs (ufo.c:2977)
==2869==    by 0x591DA96: SFReadUFO (ufo.c:4219)
==2869==    by 0x585AFAF: _ReadSplineFont (splinefont.c:1086)
==2869==    by 0x585BC2F: LoadSplineFont (splinefont.c:1346)
==2869==    by 0x571539B: ViewPostScriptFont (fontviewbase.c:1341)
==2869==    by 0x4A14022: fontforge_main (startui.c:1353)
==2869==    by 0x6257B16: (below main) (libc-start.c:310)
 Block was alloc'd at
==2869==    at 0x48357BF: malloc (vg_replace_malloc.c:299)
==2869==    by 0x8320E2C: xmlStrdup (in /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.4)
==2869==    by 0x5914716: _UFOLoadGlyph (ufo.c:2479)
==2869==    by 0x5915CB9: UFOLoadGlyph (ufo.c:2859)
==2869==    by 0x5915CB9: UFOLoadGlyphs (ufo.c:2953)
==2869==    by 0x591DA96: SFReadUFO (ufo.c:4219)
==2869==    by 0x585AFAF: _ReadSplineFont (splinefont.c:1086)
==2869==    by 0x585BC2F: LoadSplineFont (splinefont.c:1346)
==2869==    by 0x571539B: ViewPostScriptFont (fontviewbase.c:1341)
==2869==    by 0x4A14022: fontforge_main (startui.c:1353)
==2869==    by 0x6257B16: (below main) (libc-start.c:310)
(gdb) print/x sf->glyphs[1]->layers)
Junk after end of expression.
(gdb) print/x sf->glyphs[1]->layers
$8 = 0xe8f65d0
(gdb) monitor check_memory defined 0xe8f65d0 1
Address 0xE8F65D0 len 1 defined
 Address 0xe8f65d0 is 0 bytes inside a block of size 336 alloc'd
==2869==    at 0x48377D5: calloc (vg_replace_malloc.c:711)
==2869==    by 0x58B83CF: SplineCharCreate (splineutil.c:5697)
==2869==    by 0x5914577: _UFOLoadGlyph (ufo.c:2420)
==2869==    by 0x5915CB9: UFOLoadGlyph (ufo.c:2859)
==2869==    by 0x5915CB9: UFOLoadGlyphs (ufo.c:2953)
==2869==    by 0x591DA96: SFReadUFO (ufo.c:4219)
==2869==    by 0x585AFAF: _ReadSplineFont (splinefont.c:1086)
==2869==    by 0x585BC2F: LoadSplineFont (splinefont.c:1346)
==2869==    by 0x571539B: ViewPostScriptFont (fontviewbase.c:1341)
==2869==    by 0x4A14022: fontforge_main (startui.c:1353)
==2869==    by 0x6257B16: (below main) (libc-start.c:310)

(gdb) list splineutil.c:5689,5699
5689    SplineChar *SplineCharCreate(int layer_cnt) {
5690        SplineChar *sc = chunkalloc(sizeof(SplineChar));
5691        int i;
5692
5693        sc->color = COLOR_DEFAULT;
5694        sc->orig_pos = 0xffff;
5695        sc->unicodeenc = -1;
5696        sc->layer_cnt = layer_cnt;
5697        sc->layers = calloc(layer_cnt,sizeof(Layer));            <<<<<<<<<<<<<<<<<<<<<<<
5698        for ( i=0; i<layer_cnt; ++i )
5699            LayerDefault(&sc->layers[i]);

(gdb) list ufo.c:2367,2421
2367    static SplineChar *_UFOLoadGlyph(SplineFont *sf, xmlDocPtr doc, char *glifname, char* glyphname, SplineChar* existingglyph, int layerdest) {
2368        xmlNodePtr glyph, kids, contour, points;
2369        SplineChar *sc;
2370        xmlChar *format, *width, *height, *u;
2371        char *name, *tmpname;
2372        int uni;
2373        char *cpt;
2374        int newsc = 0;
2375
2376        glyph = xmlDocGetRootElement(doc);
2377        format = xmlGetProp(glyph,(xmlChar *) "format");
2378        if ( xmlStrcmp(glyph->name,(const xmlChar *) "glyph")!=0 ||
2379                (format!=NULL && xmlStrcmp(format,(xmlChar *) "1")!=0 && xmlStrcmp(format,(xmlChar *) "2")!=0)) {
2380                    LogError(_("Expected glyph file with format==1 or 2"));
2381                    xmlFreeDoc(doc);
2382                    free(format);
2383                    return( NULL );
2384        }
2385            free(format);
2386            tmpname = (char *) xmlGetProp(glyph,(xmlChar *) "name");
2387            if (glyphname != NULL) {
2388                    // We use the provided name from the glyph listing since the specification says to trust that one more.
2389                    name = copy(glyphname);
2390                    // But we still fetch the internally listed name for verification and fail on a mismatch.
2391                    if ((name == NULL) || ((name != NULL) && (tmpname != NULL) && (strcmp(glyphname, name) != 0))) {
2392                            LogError(_("Bad glyph name."));
2393                            if ( tmpname != NULL ) { free(tmpname); tmpname = NULL; }
2394                            if ( name != NULL ) { free(name); name = NULL; }
2395                            xmlFreeDoc(doc);
2396                            return NULL;
2397                    }
2398                    if ( tmpname != NULL ) { free(tmpname); tmpname = NULL; }
2399            } else {
2400                    name = tmpname;
2401            }
2402        if ( name==NULL && glifname!=NULL ) {
2403                    char *pt = strrchr(glifname,'/');
2404                    name = copy(pt+1);
2405                    for ( pt=cpt=name; *cpt!='\0'; ++cpt ) {
2406                            if ( *cpt!='_' )
2407                            *pt++ = *cpt;
2408                            else if ( islower(*name))
2409                            *name = toupper(*name);
2410                    }
2411                    *pt = '\0';
2412        } else if ( name==NULL )
2413                    name = copy("nameless");
2414            // We assign a placeholder name if no name exists.
2415            // We create a new SplineChar 
2416            if (existingglyph != NULL) {
2417                    sc = existingglyph;
2418                    free(name); name = NULL;
2419            } else {
2420            sc = SplineCharCreate(2);                                <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2421            sc->name = name;

(gdb) print/x 0xe8f65d0 + 336
$9 = 0xe8f6720
(gdb) print sizeof(Layer)
$10 = 168
(gdb) print sizeof(sf->glyphs[1]->layers[0])
$11 = 168
(gdb) print/x &(sf->glyphs[1]->layers[layerdest].splines)
$12 = 0xe8f6788
(gdb) print layerdest
$13 = 2

--> We have allocated memory to hold two elements in sf->glyphs[1]->layers
--> Unfortunately we access now the third element ... layerdest==2

(gdb) bt
#0  0x00000000058df3f4 in SFLFindOrder (sf=sf at entry=0xe6ab200, layerdest=layerdest at entry=2) at ././fontforge/svg.c:3492
#1  0x000000000591daa1 in SFReadUFO (basedir=basedir at entry=0xe060e80 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo", flags=flags at entry=0) at ././fontforge/ufo.c:4221
#2  0x000000000585afb0 in _ReadSplineFont (file=0xe6aaed0, file at entry=0x0, filename=<optimized out>, filename at entry=0xe060de0 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1086
#3  0x000000000585ba9c in ReadSplineFont (filename=filename at entry=0xe060de0 "/home/benutzer/fonts-cantarell/orig/fonts-cantarell-0.111/master_ufo/Cantarell-Regular.ufo/", openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1288
#4  0x000000000585bc30 in LoadSplineFont (filename=<optimized out>, openflags=openflags at entry=(unknown: 0)) at ././fontforge/splinefont.c:1346
#5  0x000000000571539c in ViewPostScriptFont (filename=<optimized out>, openflags=0) at ././fontforge/fontviewbase.c:1341
#6  0x0000000004a14023 in fontforge_main (argc=2, argv=0x1fff000518) at ././fontforgeexe/startui.c:1353
#7  0x0000000006257b17 in __libc_start_main (main=0x1087b0 <main>, argc=2, argv=0x1fff000518, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x1fff000508) at ../csu/libc-start.c:310
#8  0x00000000001087ea in _start ()


(gdb) list ufo.c:3736,4225
3736    SplineFont *SFReadUFO(char *basedir, int flags) {
3737        xmlNodePtr plist, dict, keys, value;
3738        xmlDocPtr doc;
3739        SplineFont *sf;
3740        xmlChar *keyname, *valname;
3741        char *stylename=NULL;
3742        char *temp, *glyphlist, *glyphdir;
3743        char *end;
3744        int as = -1, ds= -1, em= -1;
3745
3746        if ( !libxml_init_base()) {
3747            LogError(_("Can't find libxml2."));
3748    return( NULL );
3749        }
3750
3751        sf = SplineFontEmpty();
3752        SFDefaultOS2Info(&sf->pfminfo, sf, ""); // We set the default pfm values.
3753        sf->pfminfo.pfmset = 1; // We flag the pfminfo as present since we expect the U. F. O. to set any desired values.
3754        int versionMajor = -1; // These are not native SplineFont values.
3755        int versionMinor = -1; // We store the U. F. O. values and then process them at the end.
3756        sf->styleMapFamilyName = ""; // Empty default to disable fallback at export (not user-accessible anyway as of now).
3757        sf->pfminfo.stylemap = 0x0;
3758
3759        temp = buildname(basedir,"fontinfo.plist");
3760        doc = xmlParseFile(temp);
3761        free(temp);
3762        locale_t tmplocale; locale_t oldlocale; // Declare temporary locale storage.
3763        switch_to_c_locale(&tmplocale, &oldlocale); // Switch to the C locale temporarily and cache the old locale.
3764        if ( doc!=NULL ) {
3765          plist = xmlDocGetRootElement(doc);
3766          dict = FindNode(plist->children,"dict");
3767          if ( xmlStrcmp(plist->name,(const xmlChar *) "plist")!=0 || dict==NULL ) {
3768            LogError(_("Expected property list file"));
3769            xmlFreeDoc(doc);
3770          return( NULL );
3771          }
3772          for ( keys=dict->children; keys!=NULL; keys=keys->next ) {
3773            for ( value = keys->next; value!=NULL && xmlStrcmp(value->name,(const xmlChar *) "text")==0;
3774                    value = value->next );
3775            if ( value==NULL )
3776              break;
3777            if ( xmlStrcmp(keys->name,(const xmlChar *) "key")==0 ) {
3778                keyname = xmlNodeListGetString(doc,keys->children,true);
3779                valname = xmlNodeListGetString(doc,value->children,true);
3780                keys = value;
3781                if ( xmlStrcmp(keyname,(xmlChar *) "familyName")==0 ) {
3782                    if (sf->familyname == NULL) sf->familyname = (char *) valname;
3783                    else free(valname);
3784                }
3785                else if ( xmlStrcmp(keyname,(xmlChar *) "styleName")==0 ) {
3786                    if (stylename == NULL) stylename = (char *) valname;
3787                    else free(valname);
3788                }
3789                else if ( xmlStrcmp(keyname,(xmlChar *) "styleMapFamilyName")==0 ) {
3790                    if (sf->styleMapFamilyName == NULL) sf->styleMapFamilyName = (char *) valname;
3791                    else free(valname);
3792                }
3793                else if ( xmlStrcmp(keyname,(xmlChar *) "styleMapStyleName")==0 ) {
3794                    if (strcmp((char *) valname, "regular")==0) sf->pfminfo.stylemap = 0x40;
3795            else if (strcmp((char *) valname, "italic")==0) sf->pfminfo.stylemap = 0x01;
3796            else if (strcmp((char *) valname, "bold")==0) sf->pfminfo.stylemap = 0x20;
3797            else if (strcmp((char *) valname, "bold italic")==0) sf->pfminfo.stylemap = 0x21;
3798                    free(valname);
3799                }
3800                else if ( xmlStrcmp(keyname,(xmlChar *) "fullName")==0 ||
3801                        xmlStrcmp(keyname,(xmlChar *) "postscriptFullName")==0 ) {
3802                    if (sf->fullname == NULL) sf->fullname = (char *) valname;
3803                    else free(valname);
3804                }
3805                else if ( xmlStrcmp(keyname,(xmlChar *) "fontName")==0 ||
3806                        xmlStrcmp(keyname,(xmlChar *) "postscriptFontName")==0 ) {
3807                    if (sf->fontname == NULL) sf->fontname = (char *) valname;
3808                    else free(valname);
3809                }
3810                else if ( xmlStrcmp(keyname,(xmlChar *) "weightName")==0 ||
3811                        xmlStrcmp(keyname,(xmlChar *) "postscriptWeightName")==0 ) {
3812                    if (sf->weight == NULL) sf->weight = (char *) valname;
3813                    else free(valname);
3814                }
3815                else if ( xmlStrcmp(keyname,(xmlChar *) "note")==0 ) {
3816                    if (sf->comments == NULL) sf->comments = (char *) valname;
3817                    else free(valname);
3818                }
3819                else if ( xmlStrcmp(keyname,(xmlChar *) "copyright")==0 ) {
3820                    UFOAddName(sf,(char *) valname,ttf_copyright);
3821            /* sf->copyright hosts the old ASCII-only PS attribute */
3822            if (sf->copyright == NULL) sf->copyright = normalizeToASCII((char *) valname);
3823                    else free(valname);
3824                }
3825                else if ( xmlStrcmp(keyname,(xmlChar *) "trademark")==0 )
3826                    UFOAddName(sf,(char *) valname,ttf_trademark);
3827                else if ( strncmp((char *) keyname,"openTypeName",12)==0 ) {
3828                    if ( xmlStrcmp(keyname+12,(xmlChar *) "Designer")==0 )
3829                        UFOAddName(sf,(char *) valname,ttf_designer);
3830                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "DesignerURL")==0 )
3831                        UFOAddName(sf,(char *) valname,ttf_designerurl);
3832                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "Manufacturer")==0 )
3833                        UFOAddName(sf,(char *) valname,ttf_manufacturer);
3834                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "ManufacturerURL")==0 )
3835                        UFOAddName(sf,(char *) valname,ttf_venderurl);
3836                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "License")==0 )
3837                        UFOAddName(sf,(char *) valname,ttf_license);
3838                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "LicenseURL")==0 )
3839                        UFOAddName(sf,(char *) valname,ttf_licenseurl);
3840                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "Version")==0 )
3841                        UFOAddName(sf,(char *) valname,ttf_version);
3842                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "UniqueID")==0 )
3843                        UFOAddName(sf,(char *) valname,ttf_uniqueid);
3844                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "Description")==0 )
3845                        UFOAddName(sf,(char *) valname,ttf_descriptor);
3846                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "PreferredFamilyName")==0 )
3847                        UFOAddName(sf,(char *) valname,ttf_preffamilyname);
3848                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "PreferredSubfamilyName")==0 )
3849                        UFOAddName(sf,(char *) valname,ttf_prefmodifiers);
3850                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "CompatibleFullName")==0 )
3851                        UFOAddName(sf,(char *) valname,ttf_compatfull);
3852                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "SampleText")==0 )
3853                        UFOAddName(sf,(char *) valname,ttf_sampletext);
3854                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "WWSFamilyName")==0 )
3855                        UFOAddName(sf,(char *) valname,ttf_wwsfamily);
3856                    else if ( xmlStrcmp(keyname+12,(xmlChar *) "WWSSubfamilyName")==0 )
3857                        UFOAddName(sf,(char *) valname,ttf_wwssubfamily);
3858                    else
3859                        free(valname);
3860                } else if ( strncmp((char *) keyname, "openTypeHhea",12)==0 ) {
3861                    if ( xmlStrcmp(keyname+12,(xmlChar *) "Ascender")==0 ) {
3862                        sf->pfminfo.hhead_ascent = strtol((char *) valname,&end,10);
3863                        sf->pfminfo.hheadascent_add = false;
3864                    } else if ( xmlStrcmp(keyname+12,(xmlChar *) "Descender")==0 ) {
3865                        sf->pfminfo.hhead_descent = strtol((char *) valname,&end,10);
3866                        sf->pfminfo.hheaddescent_add = false;
3867                    } else if ( xmlStrcmp(keyname+12,(xmlChar *) "LineGap")==0 )
3868                        sf->pfminfo.linegap = strtol((char *) valname,&end,10);
3869                    free(valname);
3870                    sf->pfminfo.hheadset = true;
3871                } else if ( strncmp((char *) keyname,"openTypeVhea",12)==0 ) {
3872                    if ( xmlStrcmp(keyname+12,(xmlChar *) "LineGap")==0 )
3873                        sf->pfminfo.vlinegap = strtol((char *) valname,&end,10);
3874                    sf->pfminfo.vheadset = true;
3875                    free(valname);
3876                } else if ( strncmp((char *) keyname,"openTypeOS2",11)==0 ) {
3877                    sf->pfminfo.pfmset = true;
3878                    if ( xmlStrcmp(keyname+11,(xmlChar *) "Panose")==0 ) {
3879                        UFOGetByteArray(sf->pfminfo.panose,sizeof(sf->pfminfo.panose),doc,value);
3880                        sf->pfminfo.panose_set = true;
3881                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "Type")==0 ) {
3882                        sf->pfminfo.fstype = UFOGetBits(doc,value);
3883                        if ( sf->pfminfo.fstype<0 ) {
3884                            /* all bits are set, but this is wrong, OpenType spec says */
3885                            /* bits 0, 4-7 and 10-15 must be unset, go see             */
3886                            /* http://www.microsoft.com/typography/otspec/os2.htm#fst  */
3887                            LogError(_("Bad openTypeOS2type key: all bits are set. It will be ignored"));
3888                            sf->pfminfo.fstype = 0;
3889                        }
3890                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "FamilyClass")==0 ) {
3891                        char fc[2];
3892                        UFOGetByteArray(fc,sizeof(fc),doc,value);
3893                        sf->pfminfo.os2_family_class = (fc[0]<<8)|fc[1];
3894                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "WidthClass")==0 )
3895                        sf->pfminfo.width = strtol((char *) valname,&end,10);
3896                    else if ( xmlStrcmp(keyname+11,(xmlChar *) "WeightClass")==0 )
3897                        sf->pfminfo.weight = strtol((char *) valname,&end,10);
3898                    else if ( xmlStrcmp(keyname+11,(xmlChar *) "VendorID")==0 )
3899                    {
3900                        const int os2_vendor_sz = sizeof(sf->pfminfo.os2_vendor);
3901                        const int valname_len = c_strlen(valname);
3902
3903                        if( valname && valname_len <= os2_vendor_sz )
3904                            strncpy(sf->pfminfo.os2_vendor,valname,valname_len);
3905
3906                        char *temp = sf->pfminfo.os2_vendor + os2_vendor_sz - 1;
3907                        while ( *temp == 0 && temp >= sf->pfminfo.os2_vendor )
3908                            *temp-- = ' ';
3909                    }
3910                    else if ( xmlStrcmp(keyname+11,(xmlChar *) "TypoAscender")==0 ) {
3911                        sf->pfminfo.typoascent_add = false;
3912                        sf->pfminfo.os2_typoascent = strtol((char *) valname,&end,10);
3913                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "TypoDescender")==0 ) {
3914                        sf->pfminfo.typodescent_add = false;
3915                        sf->pfminfo.os2_typodescent = strtol((char *) valname,&end,10);
3916                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "TypoLineGap")==0 )
3917                        sf->pfminfo.os2_typolinegap = strtol((char *) valname,&end,10);
3918                    else if ( xmlStrcmp(keyname+11,(xmlChar *) "WinAscent")==0 ) {
3919                        sf->pfminfo.winascent_add = false;
3920                        sf->pfminfo.os2_winascent = strtol((char *) valname,&end,10);
3921                    } else if ( xmlStrcmp(keyname+11,(xmlChar *) "WinDescent")==0 ) {
3922                        sf->pfminfo.windescent_add = false;
3923                        sf->pfminfo.os2_windescent = strtol((char *) valname,&end,10);
3924                    } else if ( strncmp((char *) keyname+11,"Subscript",9)==0 ) {
3925                        sf->pfminfo.subsuper_set = true;
3926                        if ( xmlStrcmp(keyname+20,(xmlChar *) "XSize")==0 )
3927                            sf->pfminfo.os2_subxsize = strtol((char *) valname,&end,10);
3928                        else if ( xmlStrcmp(keyname+20,(xmlChar *) "YSize")==0 )
3929                            sf->pfminfo.os2_subysize = strtol((char *) valname,&end,10);
3930                        else if ( xmlStrcmp(keyname+20,(xmlChar *) "XOffset")==0 )
3931                            sf->pfminfo.os2_subxoff = strtol((char *) valname,&end,10);
3932                        else if ( xmlStrcmp(keyname+20,(xmlChar *) "YOffset")==0 )
3933                            sf->pfminfo.os2_subyoff = strtol((char *) valname,&end,10);
3934                    } else if ( strncmp((char *) keyname+11, "Superscript",11)==0 ) {
3935                        sf->pfminfo.subsuper_set = true;
3936                        if ( xmlStrcmp(keyname+22,(xmlChar *) "XSize")==0 )
3937                            sf->pfminfo.os2_supxsize = strtol((char *) valname,&end,10);
3938                        else if ( xmlStrcmp(keyname+22,(xmlChar *) "YSize")==0 )
3939                            sf->pfminfo.os2_supysize = strtol((char *) valname,&end,10);
3940                        else if ( xmlStrcmp(keyname+22,(xmlChar *) "XOffset")==0 )
3941                            sf->pfminfo.os2_supxoff = strtol((char *) valname,&end,10);
3942                        else if ( xmlStrcmp(keyname+22,(xmlChar *) "YOffset")==0 )
3943                            sf->pfminfo.os2_supyoff = strtol((char *) valname,&end,10);
3944                    } else if ( strncmp((char *) keyname+11, "Strikeout",9)==0 ) {
3945                        sf->pfminfo.subsuper_set = true;
3946                        if ( xmlStrcmp(keyname+20,(xmlChar *) "Size")==0 )
3947                            sf->pfminfo.os2_strikeysize = strtol((char *) valname,&end,10);
3948                        else if ( xmlStrcmp(keyname+20,(xmlChar *) "Position")==0 )
3949                            sf->pfminfo.os2_strikeypos = strtol((char *) valname,&end,10);
3950                    } else if ( strncmp((char *) keyname+11, "CodePageRanges",14)==0 ) {
3951                        UFOGetBitArray(doc,value,sf->pfminfo.codepages,2);
3952                        sf->pfminfo.hascodepages = true;
3953                    } else if ( strncmp((char *) keyname+11, "UnicodeRanges",13)==0 ) {
3954                        UFOGetBitArray(doc,value,sf->pfminfo.unicoderanges,4);
3955                        sf->pfminfo.hasunicoderanges = true;
3956                    }
3957                    free(valname);
3958                } else if ( strncmp((char *) keyname, "postscript",10)==0 ) {
3959                    if ( xmlStrcmp(keyname+10,(xmlChar *) "UnderlineThickness")==0 )
3960                        sf->uwidth = strtol((char *) valname,&end,10);
3961                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "UnderlinePosition")==0 )
3962                        sf->upos = strtol((char *) valname,&end,10);
3963                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "BlueFuzz")==0 )
3964                        UFOAddPrivate(sf,"BlueFuzz",(char *) valname);
3965                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "BlueScale")==0 )
3966                        UFOAddPrivate(sf,"BlueScale",(char *) valname);
3967                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "BlueShift")==0 )
3968                        UFOAddPrivate(sf,"BlueShift",(char *) valname);
3969                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "BlueValues")==0 )
3970                        UFOAddPrivateArray(sf,"BlueValues",doc,value);
3971                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "OtherBlues")==0 )
3972                        UFOAddPrivateArray(sf,"OtherBlues",doc,value);
3973                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "FamilyBlues")==0 )
3974                        UFOAddPrivateArray(sf,"FamilyBlues",doc,value);
3975                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "FamilyOtherBlues")==0 )
3976                        UFOAddPrivateArray(sf,"FamilyOtherBlues",doc,value);
3977                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "StemSnapH")==0 )
3978                        UFOAddPrivateArray(sf,"StemSnapH",doc,value);
3979                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "StemSnapV")==0 )
3980                        UFOAddPrivateArray(sf,"StemSnapV",doc,value);
3981                    else if ( xmlStrcmp(keyname+10,(xmlChar *) "ForceBold")==0 )
3982                        UFOAddPrivate(sf,"ForceBold",(char *) value->name);
3983                            /* value->name is either true or false */
3984                    free(valname);
3985                } else if ( strncmp((char *)keyname,"macintosh",9)==0 ) {
3986                    if ( xmlStrcmp(keyname+9,(xmlChar *) "FONDName")==0 )
3987                        sf->fondname = (char *) valname;
3988                    else
3989                        free(valname);
3990                } else if ( xmlStrcmp(keyname,(xmlChar *) "unitsPerEm")==0 ) {
3991                    em = strtol((char *) valname,&end,10);
3992                    if ( *end!='\0' || em < 0 ) em = -1;
3993                    free(valname);
3994                } else if ( xmlStrcmp(keyname,(xmlChar *) "ascender")==0 ) {
3995                    as = strtod((char *) valname,&end);
3996                    if ( *end!='\0' ) as = -1;
3997                    else sf->ufo_ascent = as;
3998                    free(valname);
3999                } else if ( xmlStrcmp(keyname,(xmlChar *) "descender")==0 ) {
4000                    ds = -strtod((char *) valname,&end);
4001                    if ( *end!='\0' ) ds = -1;
4002                    else sf->ufo_descent = -ds;
4003                    free(valname);
4004                } else if ( xmlStrcmp(keyname,(xmlChar *) "xHeight")==0 ) {
4005                    sf->pfminfo.os2_xheight = strtol((char *) valname,&end,10); free(valname);
4006                } else if ( xmlStrcmp(keyname,(xmlChar *) "capHeight")==0 ) {
4007                    sf->pfminfo.os2_capheight = strtol((char *) valname,&end,10); free(valname);
4008                } else if ( xmlStrcmp(keyname,(xmlChar *) "italicAngle")==0 ||
4009                        xmlStrcmp(keyname,(xmlChar *) "postscriptSlantAngle")==0 ) {
4010                    sf->italicangle = strtod((char *) valname,&end);
4011                    if ( *end!='\0' ) sf->italicangle = 0;
4012                    free(valname);
4013                } else if ( xmlStrcmp(keyname,(xmlChar *) "versionMajor")==0 ) {
4014                    versionMajor = strtol((char *) valname,&end, 10);
4015                    if ( *end!='\0' ) versionMajor = -1;
4016                    free(valname);
4017                } else if ( xmlStrcmp(keyname,(xmlChar *) "versionMinor")==0 ) {
4018                    versionMinor = strtol((char *) valname,&end, 10);
4019                    if ( *end!='\0' ) versionMinor = -1;
4020                    free(valname);
4021                } else
4022                    free(valname);
4023                free(keyname);
4024            }
4025          }
4026          xmlFreeDoc(doc);
4027        }
4028        if ( em==-1 && as>=0 && ds>=0 )
4029            em = as + ds;
4030        if ( em==as+ds ) {
4031            /* Yay! They follow my conventions */;
4032        } else if ( em!=-1 ) {
4033            as = 800*em/1000;
4034            ds = em-as;
4035            sf->invalidem = 1;
4036        }
4037        if ( em==-1 ) {
4038            LogError(_("This font does not specify unitsPerEm, so we guess 1000."));
4039            em = 1000;
4040        }
4041        sf->ascent = as; sf->descent = ds;
4042        if ( sf->fontname==NULL ) {
4043            if ( stylename!=NULL && sf->familyname!=NULL )
4044                sf->fontname = strconcat3(sf->familyname,"-",stylename);
4045            else
4046                sf->fontname = copy("Untitled");
4047        }
4048        if ( sf->fullname==NULL ) {
4049            if ( stylename!=NULL && sf->familyname!=NULL )
4050                sf->fullname = strconcat3(sf->familyname," ",stylename);
4051            else
4052                sf->fullname = copy(sf->fontname);
4053        }
4054        if ( sf->familyname==NULL )
4055            sf->familyname = copy(sf->fontname);
4056        free(stylename); stylename = NULL;
4057        if ( sf->weight==NULL )
4058            sf->weight = copy("Regular");
4059        // We first try to set the SplineFont version by using the native numeric U. F. O. values.
4060        if ( sf->version==NULL && versionMajor != -1 )
4061          injectNumericVersion(&sf->version, versionMajor, versionMinor);
4062        // If that fails, we attempt to use the TrueType values.
4063        if ( sf->version==NULL && sf->names!=NULL &&
4064                sf->names->names[ttf_version]!=NULL &&
4065                strncmp(sf->names->names[ttf_version],"Version ",8)==0 )
4066            sf->version = copy(sf->names->names[ttf_version]+8);
4067
4068            char * layercontentsname = buildname(basedir,"layercontents.plist");
4069            char ** layernames = NULL;
4070            if (layercontentsname == NULL) {
4071                    switch_to_old_locale(&tmplocale, &oldlocale); // Switch to the cached locale.
4072                    return( NULL );
4073            } else if ( GFileExists(layercontentsname)) {
4074                    xmlDocPtr layercontentsdoc = NULL;
4075                    xmlNodePtr layercontentsplist = NULL;
4076                    xmlNodePtr layercontentsdict = NULL;
4077                    xmlNodePtr layercontentslayer = NULL;
4078                    xmlNodePtr layercontentsvalue = NULL;
4079                    int layercontentslayercount = 0;
4080                    int layernamesbuffersize = 0;
4081                    int layercontentsvaluecount = 0;
4082                    if ( (layercontentsdoc = xmlParseFile(layercontentsname)) ) {
4083                            // The layercontents plist contains an array of double-element arrays. There is no top-level dict. Note that the indices in the layercontents array may not match those in the Fontforge layers array due to reserved spaces.
4084                            if ( ( layercontentsplist = xmlDocGetRootElement(layercontentsdoc) ) && ( layercontentsdict = FindNode(layercontentsplist->children,"array") ) ) {
4085                                    layercontentslayercount = 0;
4086                                    layernamesbuffersize = 2;
4087                                    layernames = malloc(2*sizeof(char*)*layernamesbuffersize);
4088                                    // Look through the children of the top-level array. Stop if one of them is not an array. (Ignore text objects since these probably just have whitespace.)
4089                                    for ( layercontentslayer = layercontentsdict->children ;
4090                                    ( layercontentslayer != NULL ) && ( ( xmlStrcmp(layercontentslayer->name,(const xmlChar *) "array")==0 ) || ( xmlStrcmp(layercontentslayer->name,(const xmlChar *) "text")==0 ) ) ;
4091                                    layercontentslayer = layercontentslayer->next ) {
4092                                            if ( xmlStrcmp(layercontentslayer->name,(const xmlChar *) "array")==0 ) {
4093                                                    xmlChar * layerlabel = NULL;
4094                                                    xmlChar * layerglyphdirname = NULL;
4095                                                    layercontentsvaluecount = 0;
4096                                                    // Look through the children (effectively columns) of the layer array (the row). Reject non-string values.
4097                                                    for ( layercontentsvalue = layercontentslayer->children ;
4098                                                    ( layercontentsvalue != NULL ) && ( ( xmlStrcmp(layercontentsvalue->name,(const xmlChar *) "string")==0 ) || ( xmlStrcmp(layercontentsvalue->name,(const xmlChar *) "text")==0 ) ) ;
4099                                                    layercontentsvalue = layercontentsvalue->next ) {
4100                                                            if ( xmlStrcmp(layercontentsvalue->name,(const xmlChar *) "string")==0 ) {
4101                                                                    if (layercontentsvaluecount == 0) layerlabel = xmlNodeListGetString(layercontentsdoc, layercontentsvalue->xmlChildrenNode, true);
4102                                                                    if (layercontentsvaluecount == 1) layerglyphdirname = xmlNodeListGetString(layercontentsdoc, layercontentsvalue->xmlChildrenNode, true);
4103                                                                    layercontentsvaluecount++;
4104                                                                    }
4105                                                    }
4106                                                    // We need two values (as noted above) per layer entry and ignore any layer lacking those.
4107                                                    if ((layercontentsvaluecount > 1) && (layernamesbuffersize < INT_MAX/2)) {
4108                                                            // Resize the layer names array as necessary.
4109                                                            if (layercontentslayercount >= layernamesbuffersize) {
4110                                                                    layernamesbuffersize *= 2;
4111                                                                    layernames = realloc(layernames, 2*sizeof(char*)*layernamesbuffersize);
4112                                                            }
4113                                                            // Fail silently on allocation failure; it's highly unlikely.
4114                                                            if (layernames != NULL) {
4115                                                                    layernames[2*layercontentslayercount] = copy((char*)(layerlabel));
4116                                                                    if (layernames[2*layercontentslayercount]) {
4117                                                                            layernames[(2*layercontentslayercount)+1] = copy((char*)(layerglyphdirname));
4118                                                                            if (layernames[(2*layercontentslayercount)+1])
4119                                                                                    layercontentslayercount++; // We increment only if both pointers are valid so as to avoid read problems later.
4120                                                                            else
4121                                                                                    free(layernames[2*layercontentslayercount]);
4122                                                                    }
4123                                                            }
4124                                                    }
4125                                                    if (layerlabel != NULL) { xmlFree(layerlabel); layerlabel = NULL; }
4126                                                    if (layerglyphdirname != NULL) { xmlFree(layerglyphdirname); layerglyphdirname = NULL; }
4127                                            }
4128                                    }
4129                                    {
4130                                            // Some typefaces (from very reputable shops) identify as following version 2 of the U. F. O. specification
4131                                            // but have multiple layers and a layercontents.plist and omit the foreground layer from layercontents.plist.
4132                                            // So, if the layercontents.plist includes no foreground layer and makes no other use of the directory glyphs
4133                                            // and if that directory exists within the typeface, we map it to the foreground.
4134                                            // Note that FontForge cannot round-trip this anomaly at present and shall include the foreground in
4135                                            // layercontents.plist in any exported U. F. O..
4136                                            int tmply = 0; // Temporary layer index.
4137                                            while (tmply < layercontentslayercount && strcmp(layernames[2*tmply], "public.default") &&
4138                                              strcmp(layernames[2*tmply+1], "glyphs")) tmply ++;
4139                                            // If tmply == layercontentslayercount then we know that no layer was named public.default and that no layer
4140                                            // used the glyphs directory.
4141                                            char * layerpath = buildname(basedir, "glyphs");
4142                                            if (tmply == layercontentslayercount && layerpath != NULL && GFileExists(layerpath)) {
4143                                                    layercontentsvaluecount = 2;
4144                                                    // Note the copying here.
4145                                                    xmlChar * layerlabel = (xmlChar*)"public.default";
4146                                                    xmlChar * layerglyphdirname = (xmlChar*)"glyphs";
4147                                                    // We need two values (as noted above) per layer entry and ignore any layer lacking those.
4148                                                    if ((layercontentsvaluecount > 1) && (layernamesbuffersize < INT_MAX/2)) {
4149                                                            // Resize the layer names array as necessary.
4150                                                            if (layercontentslayercount >= layernamesbuffersize) {
4151                                                                    layernamesbuffersize *= 2;
4152                                                                    layernames = realloc(layernames, 2*sizeof(char*)*layernamesbuffersize);
4153                                                            }
4154                                                            // Fail silently on allocation failure; it's highly unlikely.
4155                                                            if (layernames != NULL) {
4156                                                                    layernames[2*layercontentslayercount] = copy((char*)(layerlabel));
4157                                                                    if (layernames[2*layercontentslayercount]) {
4158                                                                            layernames[(2*layercontentslayercount)+1] = copy((char*)(layerglyphdirname));
4159                                                                            if (layernames[(2*layercontentslayercount)+1])
4160                                                                                    layercontentslayercount++; // We increment only if both pointers are valid so as to avoid read problems later.
4161                                                                            else
4162                                                                                    free(layernames[2*layercontentslayercount]);
4163                                                                    }
4164                                                            }
4165                                                    }
4166                                            }
4167                                            if (layerpath != NULL) { free(layerpath); layerpath = NULL; }
4168                                    }
4169
4170                                    if (layernames != NULL) {
4171                                            int lcount = 0;
4172                                            int auxpos = 2;
4173                                            int layerdest = 0;
4174                                            int bg = 1;
4175                                            if (layercontentslayercount > 0) {
4176                                                    // Start reading layers.
4177                                                    for (lcount = 0; lcount < layercontentslayercount; lcount++) {
4178                                                            // We refuse to load a layer with an incorrect prefix.
4179                                                            if (
4180                                                            (((strcmp(layernames[2*lcount],"public.default")==0) &&
4181                                                            (strcmp(layernames[2*lcount+1],"glyphs") == 0)) ||
4182                                                            (strstr(layernames[2*lcount+1],"glyphs.") == layernames[2*lcount+1])) &&
4183                                                            (glyphdir = buildname(basedir,layernames[2*lcount+1]))) {
4184                                                                    if ((glyphlist = buildname(glyphdir,"contents.plist"))) {
4185                                                                            if ( !GFileExists(glyphlist)) {
4186                                                                                    LogError(_("No glyphs directory or no contents file"));
4187                                                                            } else {
4188                                                                                    // Only public.default gets mapped as a foreground layer.
4189                                                                                    bg = 1;
4190                                                                                    // public.default and public.background have fixed mappings. Other layers start at 2.
4191                                                                                    if (strcmp(layernames[2*lcount],"public.default")==0) {
4192                                                                                            layerdest = ly_fore;
4193                                                                                            bg = 0;
4194                                                                                    } else if (strcmp(layernames[2*lcount],"public.background")==0) {
4195                                                                                            layerdest = ly_back;
4196                                                                                            sf->multilayer |= 1;
4197                                                                                    } else {
4198                                                                                            layerdest = auxpos++;
4199                                                                                            sf->multilayer |= 1;
4200                                                                                    }
4201
4202                                                                                    // We ensure that the splinefont layer list has sufficient space.
4203                                                                                    if ( layerdest+1>sf->layer_cnt ) {
4204                                                                                        sf->layers = realloc(sf->layers,(layerdest+1)*sizeof(LayerInfo));
4205                                                                                        memset(sf->layers+sf->layer_cnt,0,((layerdest+1)-sf->layer_cnt)*sizeof(LayerInfo));
4206                                                                                        sf->layer_cnt = layerdest+1;
4207                                                                                    }
4208
4209                                                                                    // The check is redundant, but it allows us to copy from sfd.c.
4210                                                                                    if (( layerdest<sf->layer_cnt ) && sf->layers) {
4211                                                                                            if (sf->layers[layerdest].name)
4212                                                                                                    free(sf->layers[layerdest].name);
4213                                                                                            sf->layers[layerdest].name = strdup(layernames[2*lcount]);
4214                                                                                            if (sf->layers[layerdest].ufo_path)
4215                                                                                                    free(sf->layers[layerdest].ufo_path);
4216                                                                                            sf->layers[layerdest].ufo_path = strdup(layernames[2*lcount+1]);
4217                                                                                            sf->layers[layerdest].background = bg;
4218                                                                                            // Fetch glyphs.
4219                                                                                            UFOLoadGlyphs(sf,glyphdir,layerdest);
4220                                                                                            // Determine layer spline order.
4221                                                                                            sf->layers[layerdest].order2 = SFLFindOrder(sf,layerdest);                  <<<<<<<<<<<<<<<<<<<<<<<<
4222                                                                                            // Conform layer spline order (reworking control points if necessary).
4223                                                                                            SFLSetOrder(sf,layerdest,sf->layers[layerdest].order2);
4224                                                                                            // Set the grid order to the foreground order if appropriate.
4225                                                                                            if (layerdest == ly_fore) sf->grid.order2 = sf->layers[layerdest].order2;



valgrind --vgdb=yes --vgdb-error=0 /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

gdb -q /usr/bin/fontforge



set width 0
set pagination off
directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
target remote | vgdb
cont
cont
cont
cont
cont
cont
cont




###################


gdb -q --args /usr/bin/fontforge master_ufo/Cantarell-Regular.ufo/

set width 0
set pagination off
directory /home/benutzer/fontforge/orig/fontforge-20170731~dfsg
b ufo.c:3751
y
b ufo.c:4173
y
run
display auxpos
display layerdest
display sf->layer_cnt




More information about the Pkg-fonts-devel mailing list