[Devel] Possible bug in freetype-2.1.3

[Tim Bosserman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have run across 3 font files which cause freetype-2.1.3 to go into an
infinite loop.  They are from the XFree86-4.1 distribution (I think -- it
is the XFree86 which comes with SuSE 7.3).  The font files are:

helvBO12.pcf.gz
lubI19-ISO8859-13.pcf.gz
lubR19-ISO8859-13.pcf.gz

from the directory /usr/X11R6/lib/X11/fonts/75dpi.

Let me know if you would like me to send you the files in question.

The infinite loop does not occur if the files are unzip'ed.  In fact, I
unzip'ed them and them gzip'ed them again, and the infinite loop did
not occur.

The infinite loop occurs in the function ft_gzip_file_io in the file
ftgzip.c.  In the for-loop which begins at line 450 and ends at line 471,
the code gets in a state where the zip buffer appears to be full.  The
"count" variable equals 1, but zip->limit and zip->cursor are equal, so
"delta" becomes zero.  The for-loop spins, unable to copy any more data.

I put in a (sleazy) workaround which notices when the for-loop has looped
multiple times without copying any data, and breaks out of the for-loop.
I don't consider this to be a fix, but just a patch to keep applications
from hanging forever when they are searching directories of font files.

The problem can be most easily duplicated by building fontconfig (from the
fcpackage-2.1 distribution), putting the fontfiles in question into a
directory (such as "badfonts") and issuing the following command:

fc-cache -v badfonts

The problem appears to still exist in freetype-2.1.4rc1.

Please feel free to contact me if I can provide any more information.

- --
Tim Bosserman
EarthLink R&D
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE+Qq/61aNrO9hu/X0RAlvlAJ4odJ28g8sgOKY8mrewNC9Q6l3nogCferni
+h8NLuAx/DGBWoef3iZxoKI=
=a45A
-----END PGP SIGNATURE-----