Bug#439071: libsdl-pango1: Segmentation fault on 64 bit processors rendering an empty string

[Jens Seidel]

Package: libsdl-pango1
Version: 0.1.2-1
Severity: important

Hi,

I noticed that SDL Pango is not able to handle empty strings "" on 64 bit
platforms. I verified it on a Intel(R) Core(TM)2 Quad CPU @ 2.40GHz CPU
(OpenSuse) but it probably fails on amd64 as well, see #438800.

It doesn't fail on my 32 bit Intel (Debian) platform.

I was able to reproduce it with a simplified testbench.c program from
SDL Pango source.

SDL_Pango-0.1.2/test> LANG=C valgrind ./testbench
==27594== Memcheck, a memory error detector.
==27594== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==27594== Using LibVEX rev 1732, a library for dynamic binary translation.
==27594== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==27594== Using valgrind-3.2.3, a dynamic binary instrumentation framework.
==27594== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==27594== For more details, rerun with: -v
==27594==
==27594== Invalid write of size 4
==27594==    at 0x4E5664E: SDL_FillRect (in /usr/lib64/libSDL-1.2.so.0.11.0)
==27594==    by 0x50BF6F7: SDLPango_Draw (in /usr/lib64/libSDL_Pango.so.1.1.0)
==27594==    by 0x50BFE14: SDLPango_CreateSurfaceDraw (in 
/usr/lib64/libSDL_Pango.so.1.1.0)
==27594==    by 0x400BE8: main (in 
/tmp/hex-a-hop/pango/SDL_Pango-0.1.2/test/testbench)
==27594==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27594==
==27594== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 5 from 2)
==27594== malloc/free: in use at exit: 316,428 bytes in 4,343 blocks.
==27594== malloc/free: 42,131 allocs, 37,788 frees, 12,007,300 bytes allocated.
==27594== For counts of detected errors, rerun with: -v
==27594== searching for pointers to 4,343 not-freed blocks.
==27594== checked 849,960 bytes.
==27594==
==27594== LEAK SUMMARY:
==27594==    definitely lost: 51,157 bytes in 1,016 blocks.
==27594==      possibly lost: 13,760 bytes in 28 blocks.
==27594==    still reachable: 251,511 bytes in 3,299 blocks.
==27594==         suppressed: 0 bytes in 0 blocks.
==27594== Rerun with --leak-check=full to see details of leaked memory.
Segmentation fault

Jens

/* Based on testbench.c from SDL Pango source, compile with
 * gcc testbench.c -I /usr/include/SDL/ -l SDL -l SDL_Pango -o testbench
 */
#include "SDL_Pango.h"

SDLPango_Context *context;
char *text;

int main(int argc, char *argv[])
{
    SDL_Surface *framebuf;
    SDL_Surface *surface;

    SDL_Init(SDL_INIT_VIDEO);
    SDLPango_Init();

    framebuf = SDL_SetVideoMode(640, 480, 32, SDL_SWSURFACE | SDL_RESIZABLE);

    context = SDLPango_CreateContext();

    SDLPango_SetDefaultColor(context, MATRIX_TRANSPARENT_BACK_WHITE_LETTER);

    SDLPango_SetMinimumSize(context, -1, 0);

    text = "";

    surface = NULL;
    SDLPango_SetText(context, text, -1);

    surface = SDLPango_CreateSurfaceDraw(context); // crashs here!

    SDLPango_FreeContext(context);

    SDL_Quit();
    return 0;
}