Package: libfontconfig1
Version: 2.8.0-3
Followup-For: Bug #635609
I actually looked at source code, at it looks fontconfig is ok.
It looks that problem is in strlen function, which employes
fact that malloc is probably 4-byte alligned from both sides,
to speed up strlen, by comparing 4-bytes at one time.
I was able to reproduce problem by this code:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main() {
char* a;
int l;
a = malloc(2);
a[0] = 'a';
a[1] = '\0';
l = strlen(a)+1;
return l;
}
compile with gcc -O2 -g -o cos cos.c
and I got
==29615== Command: ./cos
==29615==
==29615== Invalid read of size 4
==29615== at 0x804843F: main (cos.c:11)
==29615== Address 0x41b0028 is 0 bytes inside a block of size 2 alloc'd
==29615== at 0x4025018: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==29615== by 0x8048435: main (cos.c:8)
I think this bug should should be reassigned to glibc or valgrind.
strlen function is probably inlined, so it doesn't show in
the valgrind output.
Valgrind should include supression file, or this supression
file should be included in -dbg package probably.
Other possibility is to tell valgrind that actually 22-bytes
are 24-bytes in memory, so 4-byte read at 20-byte offset
is safe.
Regards,
Witek
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 3.1.0-t43-prod-up-09694-gc861cd3-dirty
Locale: LANG=pl_PL.UTF-8, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to pl_PL.UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages libfontconfig1 depends on:
ii fontconfig-config 2.8.0-3
ii libc6 2.13-21
ii libexpat1 2.0.1-7.2
ii libfreetype6 2.4.7-2
ii multiarch-support 2.13-21
ii zlib1g 1:1.2.3.4.dfsg-3
libfontconfig1 recommends no packages.
libfontconfig1 suggests no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
