Thu 07 Jul 2016 07:20:17 PM UTC, original submission:
While trying to render a bitmap of the Supplemental Multilingual Plane,
`unifontpic` suffered a segmentation fault.
Based on the traces below, I guessed that unifontpic is expecting
codepoints to be identified by 2 hex bytes, but the SMP uses 3 hex
bytes.
Using `cut` to remove the leading hex byte, the fault is avoided,
although the legends are not rendered with numerals, but instead some
other glyphs:
$ cut -c 3- < plane01.hex | unifontpic > out.bmp
Below, please find the results of `strace`, `ltrace`, and `valgrind`.
The traces were created using `unifontpic` and 'font/plane01/plane01.hex'
from Unifont version 9.0.01, built with GNU Guix. I get similar results
while using a Debian package of 8.0.01.
% strace unifontpic < ./plane01.hex > out.bmp
execve("/home/lfam/.guix-profile/bin/unifontpic", ["unifontpic"], [/* 33 vars */]) = 0
brk(NULL) = 0x19af000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fae38e2c000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/tls/x86_64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/tls/x86_64", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/tls/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/tls", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/x86_64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/x86_64", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib", {st_mode=S_IFDIR|0555, st_size=4096, ...}) = 0
open("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/tls/x86_64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/tls/x86_64", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/tls/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/tls", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/x86_64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/x86_64", 0x7ffdeceae080) = -1 ENOENT (No such file or directory)
open("/gnu/store/v39bh3ln3ncnzhyw0kd12d46kww9747v-gcc-4.9.3-lib/lib/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p*\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0444, st_size=100848, ...}) = 0
mmap(NULL, 2185952, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fae389f8000
mprotect(0x7fae38a0e000, 2093056, PROT_NONE) = 0
mmap(0x7fae38c0d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7fae38c0d000
close(3) = 0
open("/gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\7\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0555, st_size=1952536, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fae38e2b000
mmap(NULL, 3821248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fae38653000
mprotect(0x7fae387ee000, 2097152, PROT_NONE) = 0
mmap(0x7fae389ee000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19b000) = 0x7fae389ee000
mmap(0x7fae389f4000, 16064, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fae389f4000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fae38e2a000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fae38e29000
arch_prctl(ARCH_SET_FS, 0x7fae38e2a700) = 0
mprotect(0x7fae389ee000, 16384, PROT_READ) = 0
mprotect(0x7fae38e2e000, 4096, PROT_READ) = 0
fstat(0, {st_mode=S_IFREG|0644, st_size=496945, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fae38e28000
read(0, "010000:00000041417F4949080808080"..., 4096) = 4096
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x7ffdeceaf000} ---
+++ killed by SIGSEGV +++
zsh: segmentation fault strace unifontpic < ./plane01.hex > out.bmp
I also found the ltrace helpful:
[... many lines omitted ...]
__isoc99_sscanf(0x7ffd74ffc497, 0x401ff7, 0x7ffd753fdcb0, 24) = 1
__isoc99_sscanf(0x7ffd74ffc49b, 0x401ff7, 0x7ffd753fdcb4, 24) = 1
__isoc99_sscanf(0x7ffd74ffc49f, 0x401ff7, 0x7ffd753fdcb8, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4a3, 0x401ff7, 0x7ffd753fdcbc, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4a7, 0x401ff7, 0x7ffd753fdcc0, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4ab, 0x401ff7, 0x7ffd753fdcc4, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4af, 0x401ff7, 0x7ffd753fdcc8, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4b3, 0x401ff7, 0x7ffd753fdccc, 24) = 1
fgets("01005D:00000000000007C0010001003"..., 256, 0x7f077ed1b9c0) = 0x7ffd74ffc470
__isoc99_sscanf(0x7ffd74ffc470, 0x401ff4, 0x7ffd74ffc46c, 0xa30303030303030) = 1
strlen("00000000000007C0010001003FF82108"...) = 65
__isoc99_sscanf(0x7ffd74ffc477, 0x401ff7, 0x7ffd753fdcd0, 0xc100000000000000) = 1
__isoc99_sscanf(0x7ffd74ffc47b, 0x401ff7, 0x7ffd753fdcd4, 24) = 1
__isoc99_sscanf(0x7ffd74ffc47f, 0x401ff7, 0x7ffd753fdcd8, 24) = 1
__isoc99_sscanf(0x7ffd74ffc483, 0x401ff7, 0x7ffd753fdcdc, 24) = 1
__isoc99_sscanf(0x7ffd74ffc487, 0x401ff7, 0x7ffd753fdce0, 24) = 1
__isoc99_sscanf(0x7ffd74ffc48b, 0x401ff7, 0x7ffd753fdce4, 24) = 1
__isoc99_sscanf(0x7ffd74ffc48f, 0x401ff7, 0x7ffd753fdce8, 24) = 1
__isoc99_sscanf(0x7ffd74ffc493, 0x401ff7, 0x7ffd753fdcec, 24) = 1
__isoc99_sscanf(0x7ffd74ffc497, 0x401ff7, 0x7ffd753fdcf0, 24) = 1
__isoc99_sscanf(0x7ffd74ffc49b, 0x401ff7, 0x7ffd753fdcf4, 24) = 1
__isoc99_sscanf(0x7ffd74ffc49f, 0x401ff7, 0x7ffd753fdcf8, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4a3, 0x401ff7, 0x7ffd753fdcfc, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4a7, 0x401ff7, 0x7ffd753fdd00, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4ab, 0x401ff7, 0x7ffd753fdd04, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4af, 0x401ff7, 0x7ffd753fdd08, 24) = 1
__isoc99_sscanf(0x7ffd74ffc4b3, 0x401ff7, 0x7ffd753fdd0c, 24) = 1
fgets("010080:00000008087F1422222241414"..., 256, 0x7f077ed1b9c0) = 0x7ffd74ffc470
__isoc99_sscanf(0x7ffd74ffc470, 0x401ff4, 0x7ffd74ffc46c, 0xa30303030313431) = 1
strlen("00000008087F14222222414141410000"...) = 33
__isoc99_sscanf(0x7ffd74ffc477, 0x401ff7, 0x7ffd753fe590, 0xfffffffc <no return ...>
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++
And the Valgrind:
% valgrind unifontpic < ./plane01.hex > out.bmp
==20660== Memcheck, a memory error detector
==20660== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==20660== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==20660== Command: unifontpic
==20660==
==20660== Warning: client switching stacks? SP change: 0xfff000638 --> 0xffec00628
==20660== to suppress, use: --max-stackframe=4194320 or greater
==20660== Invalid write of size 8
==20660== at 0x400840: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== Address 0xffec00628 is on thread 1's stack
==20660==
==20660== Invalid write of size 8
==20660== at 0x4C2E017: memset (in /gnu/store/ix0374l9qaijsngb3izmchaj8kzjamcg-valgrind-3.11.0/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==20660== by 0x400844: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== by 0x506968F: (below main) (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== Address 0xffec00630 is on thread 1's stack
==20660==
==20660== Invalid read of size 8
==20660== at 0x4C2E03D: memset (in /gnu/store/ix0374l9qaijsngb3izmchaj8kzjamcg-valgrind-3.11.0/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==20660== by 0x400844: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== by 0x506968F: (below main) (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== Address 0xffec00628 is on thread 1's stack
==20660== in frame #0, created by memset (???:)
==20660==
==20660== Invalid write of size 4
==20660== at 0x50A1758: _IO_vfscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x50AFCEB: __isoc99_vsscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x50AFC76: __isoc99_sscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x400B88: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== by 0x40084E: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== Address 0xfff001030 is not stack'd, malloc'd or (recently) free'd
==20660==
==20660==
==20660== Process terminating with default action of signal 11 (SIGSEGV)
==20660== Access not within mapped region at address 0xFFF001030
==20660== at 0x50A1758: _IO_vfscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x50AFCEB: __isoc99_vsscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x50AFC76: __isoc99_sscanf (in /gnu/store/8m00x5x8ykmar27s9248cmhnkdb2n54a-glibc-2.22/lib/libc-2.22.so)
==20660== by 0x400B88: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== by 0x40084E: ??? (in /gnu/store/704xxak3d90qnl92bvd4a5rb7y34v7wq-font-gnu-unifont-9.0.01-bin/bin/unifontpic)
==20660== If you believe this happened as a result of a stack
==20660== overflow in your program's main thread (unlikely but
==20660== possible), you can try to increase the size of the
==20660== main thread stack using the --main-stacksize= flag.
==20660== The main thread stack size used in this run was 8388608.
==20660==
==20660== HEAP SUMMARY:
==20660== in use at exit: 0 bytes in 0 blocks
==20660== total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==20660==
==20660== All heap blocks were freed -- no leaks are possible
==20660==
==20660== For counts of detected and suppressed errors, rerun with: -v
==20660== ERROR SUMMARY: 524276 errors from 4 contexts (suppressed: 1 from 1)
zsh: segmentation fault valgrind unifontpic < ./plane01.hex > out.bmp
|