freetype-rs icon indicating copy to clipboard operation
freetype-rs copied to clipboard

Segfault during glyph outlining

Open RazrFalcon opened this issue 6 years ago • 1 comments

The glyph_outline example crashes with segfault while trying to outline the 0 glyph (I had to modify the example a bit, since it accepts only characters) using the Noto Tinos-BoldItalic.ttf (md5sum d303824b18cfd6f13838f94791b708bd).

Output: terminated by signal SIGSEGV (Address boundary error)

According to gdb it crashes here.

freetype-rs 0.20.0

RazrFalcon avatar Jun 04 '19 21:06 RazrFalcon

Yeah I'm seeing this as well. The origin of the issue (at least for me) seems to be in attempting to get an outline for a glyph with no geometry (say for example a space). This case can be reproduced via the glyph_outline example without changes via:

cargo run --example glyph_outline examples/assets/FiraSans-Regular.ttf ' '

Here I'm passing a space as the outlined character (unicode codepoint 0x20 or 32 decimal).

I've caught this in the debugger and it appears a null ptr check is needed in the following code in outline.rs

impl<'a> Iterator for ContourIterator<'a> {
    type Item = CurveIterator<'a>;

    fn next(&mut self) -> Option<Self::Item> {
        if self.contour_end_idx > self.last_end_idx {
            None
        } else {
            unsafe {
                let contour_end = *self.contour_end_idx; // <-- dereferncing a null ptr here !!!
                let curves = CurveIterator::from_raw(self.outline, self.contour_start as isize,
                                                     contour_end as isize);
                self.contour_start = contour_end + 1;
                self.contour_end_idx = self.contour_end_idx.offset(1);

                Some(curves)
            }
        }
    }
}

I could provide a PR for this as it would improve out client which is using this crate, but as you know the binding better I'll accept how you want to proceed on this.

johnoneil avatar Nov 23 '20 21:11 johnoneil