php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #32893 imagettftext crash
Submitted: 2005-04-29 21:26 UTC Modified: 2005-05-02 11:40 UTC
From: php at fiddaman dot net Assigned: pajoye (profile)
Status: Closed Package: GD related
PHP Version: 4.3.11 OS: Solaris 9
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2005-04-29 21:26 UTC] php at fiddaman dot net 
Description:
------------
PHP crashes in imagettftext - worked fine in 4.3.10

./configure \
                --prefix=/opt/php \
                --with-exec-dir=/opt/php/bin \
                --with-apxs2=/opt/apache/bin/apxs \
                --enable-memory-limit \
                --with-iconv \
                --enable-ftp \
                --enable-mbstring \
                --with-mbstring=all \
                --with-gettext \
                --enable-calendar \
                --with-mime-magic \
                --with-mysql \
                --with-mysqli=/opt/mysql/bin/mysql_config \
                \
                --with-openssl=/opt/openssl \
                --with-mysql=/opt/mysql \
                --with-gdbm=/opt/GNUgdbm \
                --with-db4=/opt/newdb \
                --with-dom=/opt/libxml2 \
                --with-gmp=/opt/GNUmp \
                --with-mcrypt=/opt/libmcrypt \
                \
                --with-imap=/opt/c-client \
                --with-imap-ssl=/opt/openssl \
                \
                --with-zlib=/usr \
                --with-zlib-dir=/usr \
                --with-bz2=/usr \
                \
                --with-gd \
                --with-jpeg-dir=/opt/libjpg \
                --with-png-dir=/opt/libpng \
                --with-freetype-dir=/opt/freetype


Reproduce code:
---------------
<?php
        $img = imagecreate(400, 70);
        $font_colour = imagecolorallocate($img, 0, 0x50, 0);

        imagettftext($img, 11/81*64, 0, 0, 27,
            "$font_colour", "/tmp/federation.ttf",
            "test");
        imagedestroy($img);
?>


Expected result:
----------------
No errors.

Actual result:
--------------
#0  0x00000001001a70b4 in zend_parse_va_args (num_args=4,
    type_spec=0x10023cd7b "lllss|a", va=0xffffffff7fffe898, flags=0)
    at /spool/src/build/php-4.3.11/Zend/zend_API.c:260
#1  0x00000001001a7b18 in zend_parse_parameters (num_args=8,
    type_spec=0x10023cd78 "rddlllss|a")
    at /spool/src/build/php-4.3.11/Zend/zend_API.c:552
#2  0x0000000100071a7c in php_imagettftext_common (ht=8,
    return_value=0x10061dd28, this_ptr=0x0, return_value_used=0, mode=0,
    extended=0) at /spool/src/build/php-4.3.11/ext/gd/gd.c:3042
#3  0x00000001001bb0c4 in execute (op_array=0x10063b2a8)
    at /spool/src/build/php-4.3.11/Zend/zend_execute.c:1654
#4  0x00000001001a64b0 in zend_execute_scripts (type=8, retval=0x0,
    file_count=3) at /spool/src/build/php-4.3.11/Zend/zend.c:926
#5  0x0000000100173ba0 in php_execute_script (primary_file=0xffffffff7ffffaa0)
    at /spool/src/build/php-4.3.11/main/main.c:1745
#6  0x00000001001c3f08 in main (argc=2, argv=0xffffffff7ffffb98)
    at /spool/src/build/php-4.3.11/sapi/cli/php_cli.c:828

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-30 03:45 UTC] sniper@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

I can't reproduce this crash.
 [2005-04-30 13:53 UTC] php at fiddaman dot net 
Same result with the snapshot:

Starting program: /spool/src/build/php4-STABLE-200504301042/sapi/cli/php t

Program received signal SIGSEGV, Segmentation fault.
0x00000001001a6df4 in zend_parse_va_args (num_args=4,
    type_spec=0x10023d1b3 "lllss|a", va=0xffffffff7fffe978, flags=0)
    at /spool/src/build/php4-STABLE-200504301042/Zend/zend_API.c:260
260                                                     *p = Z_LVAL_PP(arg);

it looks like a memory alignment problem, the SPARC MMU won't allow a 32 or 64-bit read that isn't aligned.

I added this just before line 260:

zend_printf("Alignment: %d\n", __alignof__(arg));

which gives:

% sapi/cli/php t
Alignment: 8
zsh: bus error (core dumped)  sapi/cli/php t
 [2005-05-01 01:29 UTC] pajoye@php.net 
Which Freetype version do you use?

Please give us a link to the TTF file you use.
 [2005-05-01 13:59 UTC] php at fiddaman dot net 
Here's a patch which fixes the problem. The variable being passed to the zend argument parser was too small to hold the result (int versus long).

--- ext/gd/gd.c~        2005-05-01 11:36:21.134419000 +0000
+++ ext/gd/gd.c 2005-05-01 11:42:37.369849000 +0000
@@ -3017,7 +3017,8 @@
 {
        zval *IM, *EXT = NULL;
        gdImagePtr im=NULL;
-       int col = -1, x = -1, y = -1, str_len, fontname_len, i, brect[8];
+       long col = -1, x = -1, y = -1;
+       int str_len, fontname_len, i, brect[8];
        double ptsize, angle;
        unsigned char *str = NULL, *fontname = NULL;
        char *error = NULL;


I'm using freetype 2.1.3 and gd 2.0.15 but it wasn't getting to even call a function in those libraries.

A simpler test case which doesn't need the font file. It generates an error in 4.3.10 but still crashes the snapshot.

% cat test
<?php
        $img = imagecreate(400, 70);
        imagettftext($img, 11/81*64, 0, 0, 27, 0, "/dev/null", "test");
?>


% ./php4-STABLE-200504301042/sapi/cli/php test
zsh: bus error (core dumped)  ./php4-STABLE-200504301042/sapi/cli/php test

% ./php-4.3.10/sapi/cli/php test
PHP Warning:  imagettftext(): Could not read font in /spool/src/build/test on line 3
 [2005-05-02 11:40 UTC] pajoye@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

PHP4 Branch was not synced with head.

Thanks for the notice

--Pierre
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Apr 25 23:01:29 2024 UTC