Re: OpenType with CFF outlines

[Pavel Kankovsky]

On Sun, 25 Jun 2000, Sivan Toledo wrote:

> #3  0x400879e4 in _IO_fread (buf=0x0, size=1, count=4294966855, fp=0x8082b40)
>     at iofread.c:42
> #4  0x806e417 in ft_io_stream (stream=0x8082b10, offset=671, buffer=0x0, 
>     count=4294966855) at src/base/ftsystem.c:210
> #5  0x804b7a5 in FT_Access_Frame (stream=0x8082b10, count=4294966855)
>     at src/base/ftstream.c:206
> #6  0x804e0b0 in FT_Extract_Frame (stream=0x8082b10, count=4294966855, 
>     pbytes=0xbffff75c) at src/base/ftstream.c:158

Hmm...the problem appears to be similar to that reported by Tomas Butkus
(regarding FT1):

> fread(void * 0x00000000, unsigned int 1, unsigned int 12, _iobuf *
> 0x102568e8) line 76 + 21 bytes
> TT_Read_File(void * 0x00000000, long 12) line 954 + 23 bytes
> TT_Access_Frame(long 4256041) line 313 + 12 bytes
> Load_TrueType_Collection(TFace_ * 0x00467460) line 89 + 27 bytes

In both cases, it behaves as if the allocation of a frame buffer failed
(returning a null pointer) but the failure was not detected (even if it
should be detected). Hmm.

BTW1: the value of count (4294966855) is very odd. It is (ulong) -441.
BTW2: shouldn't FT_Access_Frame's preconditions include !stream->base?

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."