Re: [ft-devel] ttfautohint: freeing invalid pointer on composite glyph in TA_sfnt_build_delta_exceptions()

[Werner LEMBERG]

> we stumbled over the following issue that is present since at least
> 1.7:
>
> 1. Unzip test.zip
> 2. fontmake -u test.ufo/ -o ttf
> 3. ttfautohint -l 8 -r 50 -G 50 -x 14 -D latn -f latn -m test.ctrl \
>    -w G -X "" master_ttf/.ttf test.ttf --symbol
>
> The program aborts with "munmap_chunk(): invalid pointer" at
> tabytecode.c:1130, which is "free(delta_before_IUP_args[i])". `i`
> always seems to be 4 here.
>
> (gdb) print *(delta_before_IUP_args[4])
> $6 = 207
>
> (gdb) print num_delta_before_IUP_args
> $7 = {0, 0, 0, 22, 0, 0}
>
> The values in the control file are arbitrary, and the crash happens
> on a composite glyph that just references another.

Thanks for the report.  Should be fixed now in git, please test!


    Werner