提交 1a878cc4 编写于 作者: P psadhukhan

8132985: Crash in freetypescaler.c due to double free

Reviewed-by: prr, simonis
上级 cfb3eca4
...@@ -60,6 +60,7 @@ typedef struct { ...@@ -60,6 +60,7 @@ typedef struct {
JNIEnv* env; JNIEnv* env;
FT_Library library; FT_Library library;
FT_Face face; FT_Face face;
FT_Stream faceStream;
jobject font2D; jobject font2D;
jobject directBuffer; jobject directBuffer;
...@@ -107,16 +108,10 @@ static void freeNativeResources(JNIEnv *env, FTScalerInfo* scalerInfo) { ...@@ -107,16 +108,10 @@ static void freeNativeResources(JNIEnv *env, FTScalerInfo* scalerInfo) {
if (scalerInfo == NULL) if (scalerInfo == NULL)
return; return;
//apparently Done_Face will only close the stream // FT_Done_Face always closes the stream, but only frees the memory
// but will not relase the memory of stream structure. // of the data structure if it was internally allocated by FT.
// We need to free it explicitly to avoid leak. // We hold on to a pointer to the stream structure if we provide it
//Direct access to the stream field might be not ideal solution as // ourselves, so that we can free it here.
// it is considred to be "private".
//Alternatively we could have stored pointer to the structure
// in the scalerInfo but this will increase size of the structure
// for no good reason
stream = scalerInfo->face->stream;
FT_Done_Face(scalerInfo->face); FT_Done_Face(scalerInfo->face);
FT_Done_FreeType(scalerInfo->library); FT_Done_FreeType(scalerInfo->library);
...@@ -128,10 +123,9 @@ static void freeNativeResources(JNIEnv *env, FTScalerInfo* scalerInfo) { ...@@ -128,10 +123,9 @@ static void freeNativeResources(JNIEnv *env, FTScalerInfo* scalerInfo) {
free(scalerInfo->fontData); free(scalerInfo->fontData);
} }
if (stream != NULL) { if (scalerInfo->faceStream != NULL) {
free(stream); free(scalerInfo->faceStream);
} }
free(scalerInfo); free(scalerInfo);
} }
...@@ -302,6 +296,9 @@ Java_sun_font_FreetypeFontScaler_initNativeScaler( ...@@ -302,6 +296,9 @@ Java_sun_font_FreetypeFontScaler_initNativeScaler(
&ft_open_args, &ft_open_args,
indexInCollection, indexInCollection,
&scalerInfo->face); &scalerInfo->face);
if (!error) {
scalerInfo->faceStream = ftstream;
}
} }
if (error || scalerInfo->directBuffer == NULL) { if (error || scalerInfo->directBuffer == NULL) {
free(ftstream); free(ftstream);
......
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.Font;
import java.awt.Graphics2D;
import java.awt.font.FontRenderContext;
import java.awt.image.BufferedImage;
import java.io.FileInputStream;
import java.io.ByteArrayInputStream;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import sun.font.Font2DHandle;
import sun.font.Font2D;
import sun.font.FontScaler;
import sun.font.Type1Font;
/**
* @bug 8132985
* @summary Tests to verify Type1 Font scaler dispose crashes
* @modules java.desktop/sun.font
*/
public class FontDisposeTest
{
public static void main(String[] args) throws Exception
{
// The bug only happens with Type 1 fonts. The Ghostscript font files
// should be commonly available. From distro pacakge or
// ftp://ftp.gnu.org/gnu/ghostscript/gnu-gs-fonts-other-6.0.tar.gz
// Pass pfa/pfb font file as argument
String path = args[0];
// Load
InputStream stream = new FileInputStream(path);
Font font = Font.createFont(Font.TYPE1_FONT,stream);
// Ensure native bits have been generated
BufferedImage img = new BufferedImage(100,100,
BufferedImage.TYPE_INT_ARGB);
Graphics2D g2d = img.createGraphics();
FontRenderContext frc = g2d.getFontRenderContext();
font.getLineMetrics("derp",frc);
// Force disposal -
// System.gc() is not sufficient.
Field font2DHandleField = Font.class.getDeclaredField("font2DHandle");
font2DHandleField.setAccessible(true);
sun.font.Font2DHandle font2DHandle =
(sun.font.Font2DHandle)font2DHandleField.get(font);
sun.font.Font2D font2D = font2DHandle.font2D;
sun.font.Type1Font type1Font = (sun.font.Type1Font)font2D;
Method getScalerMethod =
sun.font.Type1Font.class.getDeclaredMethod("getScaler");
getScalerMethod.setAccessible(true);
sun.font.FontScaler scaler =
(sun.font.FontScaler)getScalerMethod.invoke(type1Font);
// dispose should not crash due to double free
scaler.dispose();
}
}
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册