# Another ext/gd segfault

- Thread: https://externals.io/message/502
- Original archive: https://news-web.php.net/php.internals/502
- Started by Rasmus Lerdorf on 2003-03-30T18:19:05+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #502 — Rasmus Lerdorf — 2003-03-30T18:19:05+00:00

URL: https://externals.io/message/502#502

In addition to the gdFreeFontCache segfault I sent yesterday, here is an
imagettfbbox() crash.  I am starting to wonder if we have a basic
incompatibility with the current freetype lib.  This is PHP_4_3 on a
Debian box with:

ii  libfreetype6-dev                          2.1.3+2.1.4rc2-4                          FreeType 2 font engine, development files

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x407280da in FT_Alloc () from /usr/lib/libfreetype.so.6
#2  0x4072a6d5 in ft_validator_error () from /usr/lib/libfreetype.so.6
#3  0x4072b3d5 in FT_Open_Face () from /usr/lib/libfreetype.so.6
#4  0x4072b31f in FT_New_Face () from /usr/lib/libfreetype.so.6
#5  0x4044413e in fontFetch (error=0x814c448, key=0xbfffca78) at /home/rasmus/php4/ext/gd/libgd/gdft.c:445
#6  0x40445529 in gdCacheGet (head=0x814c440, keydata=0xbfffca78) at /home/rasmus/php4/ext/gd/libgd/gdcache.c:120
#7  0x40444a20 in gdImageStringFTEx (im=0x0, brect=0xbfffcba0, fg=-1, fontlist=0x814a838 "", ptsize=12, angle=0, x=-1, y=-1, string=0x814c604 "bar", strex=0x4059d480)
    at /home/rasmus/php4/ext/gd/libgd/gdft.c:823
#8  0x404448c9 in gdImageStringFT (im=0x0, brect=0xbfffcba0, fg=-1, fontlist=0x814c61c "handwriting", ptsize=12, angle=0, x=-1, y=-1, string=0x814c604 "bar")
    at /home/rasmus/php4/ext/gd/libgd/gdft.c:766
#9  0x40438c9f in php_imagettftext_common (ht=-1073756072, return_value=0x814f5b4, this_ptr=0x0, return_value_used=1, mode=1, extended=0) at /home/rasmus/php4/ext/gd/gd.c:3039
#10 0x4043880f in zif_imagettfbbox (ht=4, return_value=0x814f5b4, this_ptr=0x0, return_value_used=1) at /home/rasmus/php4/ext/gd/gd.c:2920
#11 0x40530f7e in execute (op_array=0x81448ac) at /home/rasmus/php4/Zend/zend_execute.c:1606
#12 0x405247fb in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/rasmus/php4/Zend/zend.c:864
#13 0x404ff217 in php_execute_script (primary_file=0xbffff810) at /home/rasmus/php4/main/main.c:1651
#14 0x40534b8e in apache_php_module_main (r=0x813c254, display_source_mode=0) at /home/rasmus/php4/sapi/apache/sapi_apache.c:55
#15 0x40535617 in send_php (r=0x813c254, display_source_mode=0, filename=0x0) at /home/rasmus/php4/sapi/apache/mod_php4.c:617
#16 0x405357b6 in send_parsed_php (r=0x813c254) at /home/rasmus/php4/sapi/apache/mod_php4.c:632
#17 0x08053b34 in ap_invoke_handler ()
#18 0x0806368c in ap_some_auth_required ()
#19 0x080636e8 in ap_process_request ()
#20 0x0805ce2b in ap_child_terminate ()
#21 0x0805cfbc in ap_child_terminate ()
#22 0x0805d0d9 in ap_child_terminate ()
#23 0x0805d5b5 in ap_child_terminate ()
#24 0x0805dcbd in main ()
#25 0x400e2a51 in __libc_start_main () from /lib/libc.so.6

---

## #515 — Ilia A. — 2003-03-30T21:03:07+00:00

URL: https://externals.io/message/502#515 · In reply to: #502

> I am starting to wonder if we have a basic
> incompatibility with the current freetype lib.  This is PHP_4_3 on a
> Debian box with:
>
> ii  libfreetype6-dev                          2.1.3+2.1.4rc2-4             
>             FreeType 2 font engine, development files

I use libfreetype.so.6.3.2 and have not encountered such problems, is there a 
way to see the actual PHP script, which causes this crash?

Ilia

---

## #516 — Rasmus Lerdorf — 2003-03-30T21:32:15+00:00

URL: https://externals.io/message/502#516 · In reply to: #515

Here is the script:

<?php
$text = urldecode(substr($PATH_INFO,1));

$font = 'handwriting';
if(!$size) $size = 12;
$im = ImageCreateFromPNG('button.png');
$tsize = imagettfbbox($size,0,$font,$text);
$dx = abs($tsize[2]-$tsize[0]);
$dy = abs($tsize[5]-$tsize[3]);
$x = ( imagesx($im) - $dx ) / 2;
$y = ( imagesy($im) - $dy ) / 2 + $dy;
$black = ImageColorAllocate($im,0,0,0);
ImageAlphaBlending($im, true);
ImageTTFText($im, $size, 0, $x, $y, $black, $font, $text);
Header('Content-type: image/png');
ImagePNG($im);
?>

That button.png image is here: http://lerdorf.com/images/button.png
And I have put the handwriting.ttf file at lerdorf.com/handwriting.ttf

I get the RSHUTDOWN crash on about 30% of the hits to that script and the
imagettfbbox() crash very infrequently.

-Rasmus



> 
> > […]
>
> I use libfreetype.so.6.3.2 and have not encountered such problems, is there a
> way to see the actual PHP script, which causes this crash?
>
> Ilia