I think the bug occurs because, in your pdf file, embedded font 
HelveticaNeue-H75 does not define FontBBox in its FontFile.

So, in T1_GetFontBBox, a crash occurs at
obj =
&(pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP[0]);
(because 
pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP 
is still NULL)

I also investigated to find if other unspecified properties could cause
other crashes, and discovered that if Encoding is not set, t1lib also
crashed (in T1_LoadFont) because of that line.

 if (strcmp( (char
     
*)pFontBase->pFontArray[FontID].pType1Data->fontInfoP[ENCODING].value.data.arrayP[i].data.arrayP,

you can reproduce that bug by editing 
/usr/share/fonts/type1/gsfonts/n019003l.pfb
and replacing
/Encoding StandardEncoding def
with 
/Ancoding StandardEncoding def
(don't modify file length though)
and launching attached pdf genplano.pdf.bz2 (or any other pdf using 
that font)


I attach a patch (for t1lib-5.1.0 or t1lib-5.1.1), to set default values
to fontbbox ([0 0 0 0]) and encoding (StandardEncoding) if they are not
defined in font file, but I don't known if it's a good idea, or if it
would be preferable to stop processing and to return an error.

arno



reassign 313236 t1lib
--
--- lib/t1lib/t1load.c.bak	2007-08-19 16:12:43.000000000 +0200
+++ lib/t1lib/t1load.c	2007-08-19 16:15:30.000000000 +0200
@@ -160,6 +160,27 @@ int T1_LoadFont( int FontID)
   free(FileNamePath);
 
   
+  /* set some default values if not assigned to avoid library crash */
+  /* XXX: may be it is better to issue error, and return -1 */
+  if (pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP == NULL) {
+    if ((pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP =  
+          (psobj *)vm_alloc(4 * sizeof(psobj))) == NULL) {
+         T1_PrintLog( "T1_LoadFont()", "Error allocating memory for fontbbox objects (FontID=%d)", 
+            T1LOG_WARNING, FontID);
+         T1_errno=T1ERR_ALLOC_MEM;
+         return(-1);
+      }
+      for (i = 0; i < 4; i++) {
+          pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP[i].type = OBJ_INTEGER;
+          pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP[i].len = 0;
+          pFontBase->pFontArray[FontID].pType1Data->fontInfoP[FONTBBOX].value.data.arrayP[i].data.integer = 0;
+     }
+  }
+  if (pFontBase->pFontArray[FontID].pFontEnc == NULL && 
+       pFontBase->pFontArray[FontID].pType1Data->fontInfoP[ENCODING].value.data.arrayP == NULL) {
+    pFontBase->pFontArray[FontID].pType1Data->fontInfoP[ENCODING].value.data.valueP = (char *) StdEncArrayP;
+  }
+
   /* Store the base address of virtual memory and realloc in order not
      to waste too much memory: */
   pFontBase->pFontArray[FontID].vm_base=vm_base; 

Attachment: signature.asc
Description: Digital signature

Reply via email to