[Bug 513582] New: segfault in FTC_CMapCache_Lookup()

[bugzilla at redhat.com]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

Summary: segfault in FTC_CMapCache_Lookup()

https://bugzilla.redhat.com/show_bug.cgi?id=513582

           Summary: segfault in FTC_CMapCache_Lookup()
           Product: Fedora
           Version: 11
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: medium
          Priority: low
         Component: freetype
        AssignedTo: besfahbo at redhat.com
        ReportedBy: fabrice at bellet.info
         QAContact: extras-qa at fedoraproject.org
                CC: fabrice at bellet.info, besfahbo at redhat.com,
                    kevin at tigcc.ticalc.org,
                    fedora-fonts-bugs-list at redhat.com
    Classification: Fedora


I have a VTK application that segfaults in libfreetype, when text in rendered.
I tried to look for details with gdb, and the problem seems to be in the
inlined code of FTC_CACHE_LOOKUP_CMP, called just before ftccmap.c:382. The
crash occurs when optimization is enabled. In this case, node is stored in a
register, and for an unknown reason, node is reset to zero before being
dereferenced.

The code following the _Ok label, in the macro definition of
FTC_CACHE_LOOKUP_CMP

 _pnode = (FTC_Node*)(void*)&(node);
 *_pnode = _node;

seems equivalent to this simpler version :

 node = _node;

And the app no longer crashes with this fix. 

I'll attach the simple VTK app that generates the crash for me. Compile it,
with vtk-devel installed, with : 
gcc -c AppliPlanes.cxx -I/usr/include/vtk
gcc -o AppliPlanes AppliPlanes.o -lvtkRendering

-- 
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.