Hello,

With xtt backend, loading a proportional iso10646 font always results
in X server crash. This is also responsible for some of the mysterious
mozilla crashing X problems. Because mozilla some times load iso10646 font
even without user's explicit request. The problem is caused by the following
code inside the "freetype_compute_bounds" function in
xc/extras/X-TrueType/xttfuncs.c (between line 1073 and 1114):

        xCharInfo *tmpchar = NULL;
        ...
        for (row = ...) {
            for (col = ...) {
                c = row<<8|col;
                ...
                if (c)
                    tmpchar = get_metrics( ... );

                if (!tmpchar->characterWidth)
                    ^^^^^^^^
                ...
            }
        }

The above code loop through all characters in an encoding to get their
metrics. If the very first "c" is 0, there's a problem of referencing
null pointer "tmpchar" at where I marked with ^. For most of the encodings
in xtt implementation, character does not start from 0. Iso10646 is one
of a few that does, thus manifest the problem. The problem exists in all 
versions of 4.x.

A trivial fix is attached.

Regards,
rigel


--- xc/extras/X-TrueType/xttfuncs.c.orig        Sun Mar 31 00:56:14 2002
+++ xc/extras/X-TrueType/xttfuncs.c     Mon Apr  1 22:27:28 2002
@@ -1100,7 +1100,7 @@
                                 char_width);
                 }
 
-            if (!tmpchar->characterWidth)
+            if (!tmpchar || !tmpchar->characterWidth)
                 continue;
 
                 adjust_min_max(&minchar, &maxchar, tmpchar);

_______________________________________________
Fonts mailing list
[EMAIL PROTECTED]
http://XFree86.Org/mailman/listinfo/fonts

Reply via email to