Bug 471538

Created attachment 323539 [details]
Problematic OTF File 1

Created attachment 323540 [details]
Problematic OTF File 2

Yeah, I am seeing this here as well on f10/rawhide.

Copyright (c) 2000-2008 by George Williams.
 Executable based on sources from 00:23 GMT 28-Aug-2008.
 Library based on sources from 23:33 GMT 27-Aug-2008.
*** buffer overflow detected ***: fontforge terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x3b448ff497]
/lib64/libc.so.6[0x3b448fd340]
/lib64/libc.so.6[0x3b448fc6c9]
/lib64/libc.so.6(__printf_fp+0x1813)[0x3b4484c453]
/lib64/libc.so.6(_IO_vfprintf+0x1d76)[0x3b448475a6]
/lib64/libc.so.6(__vsprintf_chk+0x9d)[0x3b448fc76d]
/lib64/libc.so.6(__sprintf_chk+0x80)[0x3b448fc6b0]
/usr/lib64/libfontforge.so.1[0x3b48944c46]
/usr/lib64/libfontforge.so.1[0x3b48944d78]
/usr/lib64/libfontforge.so.1[0x3b4894511d]
/usr/lib64/libfontforge.so.1[0x3b4894f147]
/usr/lib64/libfontforge.so.1(_SFReadTTF+0x844)[0x3b48952b14]
/usr/lib64/libfontforge.so.1(_ReadSplineFont+0x730)[0x3b489d6760]
/usr/lib64/libfontforge.so.1(LoadSplineFont+0xcc)[0x3b489d797c]
/usr/lib64/libfontforge.so.1(ViewPostscriptFont+0x15)[0x3b488cb7a5]
fontforge[0x4c6740]
fontforge[0x5565b8]
/lib64/libc.so.6(__libc_start_main+0xe6)[0x3b4481e546]
fontforge[0x419119]
======= Memory map: ========
00400000-005b0000 r-xp 00000000 fd:01 2597372                            /usr/bin/fontforge
007b0000-00904000 rw-p 001b0000 fd:01 2597372                            /usr/bin/fontforge
00904000-00909000 rw-p 00904000 00:00 0 
00b03000-00b09000 rw-p 00303000 fd:01 2597372                            /usr/bin/fontforge
01558000-018c3000 rw-p 01558000 00:00 0                                  [heap]
3b44400000-3b44420000 r-xp 00000000 fd:01 7077902                        /lib64/ld-2.9.so
3b4461f000-3b44620000 r--p 0001f000 fd:01 7077902                        /lib64/ld-2.9.so
3b44620000-3b44621000 rw-p 00020000 fd:01 7077902                        /lib64/ld-2.9.so
3b44800000-3b44968000 r-xp 00000000 fd:01 7077910                        /lib64/libc-2.9.so
3b44968000-3b44b68000 ---p 00168000 fd:01 7077910                        /lib64/libc-2.9.so
3b44b68000-3b44b6c000 r--p 00168000 fd:01 7077910                        /lib64/libc-2.9.so
3b44b6c000-3b44b6d000 rw-p 0016c000 fd:01 7077910                        /lib64/libc-2.9.so
3b44b6d000-3b44b72000 rw-p 3b44b6d000 00:00 0 
3b44c00000-3b44c84000 r-xp 00000000 fd:01 7077923                        /lib64/libm-2.9.so
3b44c84000-3b44e83000 ---p 00084000 fd:01 7077923                        /lib64/libm-2.9.so
3b44e83000-3b44e84000 r--p 00083000 fd:01 7077923                        /lib64/libm-2.9.so
3b44e84000-3b44e85000 rw-p 00084000 fd:01 7077923                        /lib64/libm-2.9.so
3b45000000-3b45002000 r-xp 00000000 fd:01 7077942                        /lib64/libdl-2.9.so
3b45002000-3b45202000 ---p 00002000 fd:01 7077942                        /lib64/libdl-2.9.so
3b45202000-3b45203000 r--p 00002000 fd:01 7077942                        /lib64/libdl-2.9.so
3b45203000-3b45204000 rw-p 00003000 fd:01 7077942                        /lib64/libdl-2.9.so
3b45400000-3b45417000 r-xp 00000000 fd:01 7077991                        /lib64/libpthread-2.9.so
3b45417000-3b45616000 ---p 00017000 fd:01 7077991                        /lib64/libpthread-2.9.so
3b45616000-3b45617000 r--p 00016000 fd:01 7077991                        /lib64/libpthread-2.9.so
3b45617000-3b45618000 rw-p 00017000 fd:01 7077991                        /lib64/libpthread-2.9.so
3b45618000-3b4561c000 rw-p 3b45618000 00:00 0 
3b45800000-3b45812000 r-xp 00000000 fd:01 11638419                       /usr/lib64/libgutils.so.1.0.3
3b45812000-3b45a11000 ---p 00012000 fd:01 11638419                       /usr/lib64/libgutils.so.1.0.3
3b45a11000-3b45a14000 rw-p 00011000 fd:01 11638419                       /usr/lib64/libgutils.so.1.0.3
3b45c00000-3b45c05000 r-xp 00000000 fd:01 2662617                        /usr/lib64/libXdmcp.so.6.0.0
3b45c05000-3b45e04000 ---p 00005000 fd:01 2662617                        /usr/lib64/libXdmcp.so.6.0.0
3b45e04000-3b45e05000 rw-p 00004000 fd:01 2662617                        /usr/lib64/libXdmcp.so.6.0.0
3b46000000-3b4601a000 r-xp 00000000 fd:01 2662619                        /usr/lib64/libxcb.so.1.0.0
3b4601a000-3b4621a000 ---p 0001a000 fd:01 2662619                        /usr/lib64/libxcb.so.1.0.0
3b4621a000-3b4621b000 rw-p 0001a000 fd:0[1]    30669 abort      fontforge

Will see about asking upstream to take a look...

Note that upstream released a new version a few days after I had rebuilt fontforge in rawhide/f11. May be worth trying too

$ rpm -q fontforge
fontforge-20080927-1.fc11.i386

$ fontforge
Copyright (c) 2000-2008 by George Williams.
 Executable based on sources from 02:38 GMT 27-Sep-2008.
 Library based on sources from 15:05 GMT 25-Sep-2008.
*** buffer overflow detected ***: fontforge terminated
======= Backtrace: =========
...
...
00c9c000-00cb1000 r-xp 00000000 08:0Aborted (core dumped)

$gdb /usr/bin/fontforge fontforge-12150-1226998262.core

GNU gdb Fedora (6.8-23.fc9)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libfontforge.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib/libfontforge.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libfontforge.so.1.0.0
Reading symbols from /usr/lib/libgdraw.so.4.0.5...Reading symbols from /usr/lib/debug/usr/lib/libgdraw.so.4.0.5.debug...done.
done.
Loaded symbols for /usr/lib/libgdraw.so.4.0.5
Reading symbols from /usr/lib/libgutils.so.1.0.3...Reading symbols from /usr/lib/debug/usr/lib/libgutils.so.1.0.3.debug...done.
done.
Loaded symbols for /usr/lib/libgutils.so.1.0.3
Reading symbols from /usr/lib/libgunicode.so.3.0.0...Reading symbols from /usr/lib/debug/usr/lib/libgunicode.so.3.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libgunicode.so.3.0.0
Reading symbols from /usr/lib/libSM.so.6.0.0...Reading symbols from /usr/lib/debug/usr/lib/libSM.so.6.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libSM.so.6.0.0
Reading symbols from /usr/lib/libICE.so.6.3.0...Reading symbols from /usr/lib/debug/usr/lib/libICE.so.6.3.0.debug...done.
done.
Loaded symbols for /usr/lib/libICE.so.6.3.0
Reading symbols from /usr/lib/libX11.so.6.2.0...Reading symbols from /usr/lib/debug/usr/lib/libX11.so.6.2.0.debug...done.
done.
Loaded symbols for /usr/lib/libX11.so.6.2.0
Reading symbols from /lib/libdl-2.8.so...Reading symbols from /usr/lib/debug/lib/libdl-2.8.so.debug...done.
done.
Loaded symbols for /lib/libdl-2.8.so
Reading symbols from /lib/libpthread-2.8.so...Reading symbols from /usr/lib/debug/lib/libpthread-2.8.so.debug...done.
done.
Loaded symbols for /lib/libpthread-2.8.so
Reading symbols from /lib/libm-2.8.so...Reading symbols from /usr/lib/debug/lib/libm-2.8.so.debug...done.
done.
Loaded symbols for /lib/libm-2.8.so
Reading symbols from /lib/libc-2.8.so...Reading symbols from /usr/lib/debug/lib/libc-2.8.so.debug...done.
done.
Loaded symbols for /lib/libc-2.8.so
Reading symbols from /lib/libuuid.so.1.2...Reading symbols from /usr/lib/debug/lib/libuuid.so.1.2.debug...done.
done.
Loaded symbols for /lib/libuuid.so.1.2
Reading symbols from /usr/lib/libxcb-xlib.so.0.0.0...Reading symbols from /usr/lib/debug/usr/lib/libxcb-xlib.so.0.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libxcb-xlib.so.0.0.0
Reading symbols from /usr/lib/libxcb.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib/libxcb.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libxcb.so.1.0.0
Reading symbols from /lib/ld-2.8.so...Reading symbols from /usr/lib/debug/lib/ld-2.8.so.debug...done.
done.
Loaded symbols for /lib/ld-2.8.so
Reading symbols from /usr/lib/libXau.so.6.0.0...Reading symbols from /usr/lib/debug/usr/lib/libXau.so.6.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libXau.so.6.0.0
Reading symbols from /usr/lib/libXdmcp.so.6.0.0...Reading symbols from /usr/lib/debug/usr/lib/libXdmcp.so.6.0.0.debug...done.
done.
Loaded symbols for /usr/lib/libXdmcp.so.6.0.0
Reading symbols from /usr/lib/gconv/ISO8859-1.so...Reading symbols from /usr/lib/debug/usr/lib/gconv/ISO8859-1.so.debug...done.
done.
Loaded symbols for /usr/lib/gconv/ISO8859-1.so
Reading symbols from /usr/lib/gconv/MACINTOSH.so...Reading symbols from /usr/lib/debug/usr/lib/gconv/MACINTOSH.so.debug...done.
done.
Loaded symbols for /usr/lib/gconv/MACINTOSH.so
Reading symbols from /usr/lib/libXcursor.so.1.0.2...Reading symbols from /usr/lib/debug/usr/lib/libXcursor.so.1.0.2.debug...done.
done.
Loaded symbols for /usr/lib/libXcursor.so.1.0.2
Reading symbols from /usr/lib/libXrender.so.1.3.0...Reading symbols from /usr/lib/debug/usr/lib/libXrender.so.1.3.0.debug...done.
done.
Loaded symbols for /usr/lib/libXrender.so.1.3.0
Reading symbols from /usr/lib/libXfixes.so.3.1.0...Reading symbols from /usr/lib/debug/usr/lib/libXfixes.so.3.1.0.debug...done.
done.
Loaded symbols for /usr/lib/libXfixes.so.3.1.0
Reading symbols from /lib/libgcc_s-4.3.0-20080428.so.1...Reading symbols from /usr/lib/debug/lib/libgcc_s-4.3.0-20080428.so.1.debug...done.
done.
Loaded symbols for /lib/libgcc_s-4.3.0-20080428.so.1
Core was generated by `fontforge'.
Program terminated with signal 6, Aborted.
[New process 12150]
#0  0x00110416 in __kernel_vsyscall ()
(gdb) bt full
#0  0x00110416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00b0b660 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
	resultvar = <value optimized out>
	pid = <value optimized out>
	selftid = <value optimized out>
#2  0x00b0d028 in abort () at abort.c:88
	act = Could not find the frame base for "abort".
	sigs = Could not find the frame base for "abort".
#3  0x00b4864d in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>)
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
	ap = <value optimized out>
	fd = 5
	on_2 = <value optimized out>
	list = <value optimized out>
	nlist = <value optimized out>
	cp = <value optimized out>
	written = <value optimized out>
#4  0x00bd7c78 in __fortify_fail (msg=Could not find the frame base for "__fortify_fail".
) at fortify_fail.c:32
No locals.
#5  0x00bd5d70 in __chk_fail () at chk_fail.c:29
No locals.
#6  0x00bd5468 in _IO_str_chk_overflow (fp=Could not find the frame base for "_IO_str_chk_overflow".
) at vsprintf_chk.c:35
No locals.
#7  0x00b4d9a3 in __overflow (f=<value optimized out>, ch=Could not find the frame base for "__overflow".
) at genops.c:248
No locals.
#8  0x00b25de9 in ___printf_fp (fp=<value optimized out>, info=<value optimized out>, 
    args=<value optimized out>) at printf_fp.c:1206
	outlen = <value optimized out>
	buffer = <value optimized out>
	cp = <value optimized out>
	tmpptr = <value optimized out>
	wstartp = <value optimized out>
	intdig_max = <value optimized out>
	intdig_no = <value optimized out>
	fracdig_max = <value optimized out>
	fracdig_no = <value optimized out>
	width = <value optimized out>
	expscale = <value optimized out>
	ngroups = <value optimized out>
	wbuffer_to_alloc = <value optimized out>
	fracdig_min = <value optimized out>
	dig_max = <value optimized out>
	significant = <value optimized out>
	wcp = <value optimized out>
	chars_needed = <value optimized out>
	spec = <value optimized out>
	added_zeros = <value optimized out>
	decimal = <value optimized out>
	decimalwc = <value optimized out>
	thousands_sep = <value optimized out>
	thousands_sepwc = <value optimized out>
	grouping = <value optimized out>
	special = <value optimized out>
	wspecial = <value optimized out>
	fp_input = Could not find the frame base for "___printf_fp".
	to_shift = <value optimized out>
	is_neg = 0
	tmpsize = <value optimized out>
	digit = <value optimized out>
	done = <value optimized out>
	cy = <value optimized out>
	wide = 0
	wbuffer = <value optimized out>
	buffer_malloced = <value optimized out>
	expsign = Could not find the frame base for "___printf_fp".
	exponent = Could not find the frame base for "___printf_fp".
	fracsize = Could not find the frame base for "___printf_fp".
	frac = Could not find the frame base for "___printf_fp".
	tmp = Could not find the frame base for "___printf_fp".
	scale = Could not find the frame base for "___printf_fp".
	scalesize = Could not find the frame base for "___printf_fp".
	type = Could not find the frame base for "___printf_fp".
#9  0x00b20e92 in _IO_vfprintf_internal (s=<value optimized out>, format=<value optimized out>, 
    ap=<value optimized out>) at vfprintf.c:1580
	info = Could not find the frame base for "_IO_vfprintf_internal".
	ptr = <value optimized out>
	function_done = <value optimized out>
	alt = <value optimized out>
	is_long = <value optimized out>
	prec = <value optimized out>
	is_negative = <value optimized out>
	number = <value optimized out>
	base = <value optimized out>
	string = <value optimized out>
	space = <value optimized out>
	width = <value optimized out>
	showsign = <value optimized out>
	group = <value optimized out>
	is_char = <value optimized out>
	pad = <value optimized out>
	the_arg = Could not find the frame base for "_IO_vfprintf_internal".
	left = <value optimized out>
	is_long_double = <value optimized out>
	is_short = <value optimized out>
	use_outdigits = <value optimized out>
	spec = <value optimized out>
	_buffer = Could not find the frame base for "_IO_vfprintf_internal".
	_avail = <value optimized out>
	thousands_sep = <value optimized out>
	grouping = <value optimized out>
	done = <value optimized out>
	f = <value optimized out>
	lead_str_end = <value optimized out>
	work_buffer = Could not find the frame base for "_IO_vfprintf_internal".
	workstart = <value optimized out>
	workend = <value optimized out>
	ap_save = <value optimized out>
	nspecs_done = <value optimized out>
	save_errno = 20
	readonly_format = <value optimized out>
	jump_table = {1, 0, 0, 4, 0, 14, 0, 6, 0, 0, 7, 2, 0, 3, 9, 0, 5, 8, 8, 8, 8, 8, 8, 8, 8, 
  8, 0, 0, 0, 0, 0, 0, 0, 26, 0, 25, 0, 19, 19, 19, 0, 29, 0, 0, 12, 0, 0, 0, 0, 0, 0, 21, 0, 0, 0, 
  0, 18, 0, 13, 0, 0, 0, 0, 0, 0, 26, 0, 20, 15, 19, 19, 19, 10, 15, 28, 0, 11, 24, 23, 17, 22, 12, 
  0, 21, 27, 16, 0, 0, 18, 0, 13}
	step0_jumps = {0, 2233, 5485, 4766, 5570, 3668, 3772, 5253, 2453, 2641, 4267, 4182, -2518, 
  5034, 459, 1713, 1683, 1698, 1128, 1947, -858, -31, 1791, -617, -539, -2407, -2989, 5129, -2518, 
  5168}
	step1_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 2641, 4267, 4182, -2518, 5034, 459, 1713, 1683, 
  1698, 1128, 1947, -858, -31, 1791, -617, -539, -2407, -2989, 5129, -2518, 0}
	step2_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4267, 4182, -2518, 5034, 459, 1713, 1683, 
  1698, 1128, 1947, -858, -31, 1791, -617, -539, -2407, -2989, 5129, -2518, 0}
	step3a_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4350, 0, 0, 0, 459, 1713, 1683, 1698, 1128, 
  0, 0, 0, 0, -617, 0, 0, 0, 0, 0, 0}
	step3b_jumps = {0 <repeats 11 times>, -2518, 0, 0, 459, 1713, 1683, 1698, 1128, 1947, -858, 
  -31, 1791, -617, -539, -2407, -2989, 0, 0, 0}
	step4_jumps = {0 <repeats 14 times>, 459, 1713, 1683, 1698, 1128, 1947, -858, -31, 1791, 
  -617, -539, -2407, -2989, 0, 0, 0}
	step4_jumps = {4445 <repeats 14 times>, 372, 523, 2316, 2441, 4666, 4681, 3370, 2848, 3986, 
  4858, 4969, -1935, 3868, 4445, 4445, 4445}
#10 0x00bd5517 in ___vsprintf_chk (s=<value optimized out>, flags=<value optimized out>, 
    slen=<value optimized out>, format=Could not find the frame base for "___vsprintf_chk".
) at vsprintf_chk.c:87
	f = Could not find the frame base for "___vsprintf_chk".
	ret = 0
#11 0x00bd545d in ___sprintf_chk (s=Could not find the frame base for "___sprintf_chk".
) at sprintf_chk.c:33
	done = 0
#12 0x0021dd11 in privateaddreal (private=0x892fc88, key=0x369dda "BlueScale", 
    val=0.0042127701453864574, def=0.039625) at /usr/include/bits/stdio2.h:34
	buf = "0.0042127ÿ"
#13 0x0021de33 in cffprivatefillup (private=0x892fc88, dict=0x886f030) at parsettf.c:3570
No locals.
#14 0x0021e20d in cffinfofillup (info=0xbf9c834c, dict=0x886f030, strings=0x892a8f0, scnt=398)
    at parsettf.c:3681
No locals.
#15 0x002295cf in readcffglyphs (ttf=0x8872330, info=0xbf9c834c) at parsettf.c:3699
	hdrsize = <value optimized out>
	fontnames = (char **) 0x88ad770
	strings = (char **) 0x892a8f0
	dicts = (struct topdicts **) 0x88b0600
	subdicts = <value optimized out>
	i = <value optimized out>
	which = <value optimized out>
	gsubs = {cnt = 0, next = 0, keys = 0x0, values = 0x0, lens = 0x0, bias = 0}
	scnt = 398
#16 0x0022d7f7 in _SFReadTTF (ttf=0x8872330, flags=<value optimized out>, openflags=0, 
    filename=0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf", fd=0x0)
    at parsettf.c:5450
	info = {emsize = 1000, ascent = 800, descent = 200, vertical_origin = 0, width_cnt = 618, 
  glyph_cnt = 618, index_to_loc_is_long = 0, is_ttc = 0, is_onebyte = 0, twobytesymbol = 0, 
  complainedbeyondglyfend = 0, extensionrequested = 0, to_order2 = 0, complainedmultname = 0, 
  strokedfont = 0, use_typo_metrics = 1, weight_width_slope_only = 0, optimized_for_cleartype = 0, 
  apply_lsb = 0, openflags = 0, 
  copyright = 0x88b74f8 "Created by ,,, with FontForge 2.0 (http://fontforge.sf.net)", 
  familyname = 0x88af610 "Boisik", fullname = 0x8862c10 "Boisik", weight = 0x892fc78 "Medium", 
  version = 0x889a088 "001.000", fontname = 0x889ca20 "Boisik", xuid = 0x0, uniqueid = 0, 
  italicAngle = 0, upos = -100, uwidth = 50, strokewidth = 0, fstype = 0, private = 0x892fc88, 
  map = 0x0, uni_interp = ui_none, pfminfo = {pfmset = 0, winascent_add = 0, windescent_add = 0, 
    hheadascent_add = 0, hheaddescent_add = 0, typoascent_add = 0, typodescent_add = 0, 
    subsuper_set = 0, panose_set = 0, hheadset = 1, vheadset = 0, hascodepages = 0, 
    hasunicoderanges = 0, pfmfamily = 0 '\0', weight = 0, width = 0, 
    panose = "\000\000\000\000\000\000\000\000\000", fstype = 0, linegap = 90, vlinegap = 0, 
    hhead_ascent = 841, hhead_descent = -341, os2_typoascent = 0, os2_typodescent = 0, 
    os2_typolinegap = 0, os2_winascent = 0, os2_windescent = 0, os2_subxsize = 0, os2_subysize = 0, 
    os2_subxoff = 0, os2_subyoff = 0, os2_supxsize = 0, os2_supysize = 0, os2_supxoff = 0, 
    os2_supyoff = 0, os2_strikeysize = 0, os2_strikeypos = 0, os2_vendor = "\000\000\000", 
    os2_family_class = 0, codepages = {0, 0}, unicoderanges = {0, 0, 0, 0}}, os2_version = 0, 
  gasp_version = 0, dupnamestate = 0, names = 0x892bbd0, fontcomments = 0x0, fontlog = 0x0, 
  cvt_names = 0x0, chars = 0x0, layers = 0x0, layer_cnt = 0, bitmaps = 0x0, cidregistry = 0x0, 
  ordering = 0x0, supplement = 0, cidfontversion = 0, subfontcnt = 0, subfonts = 0x0, inuse = 0x0, 
  numtables = 10, base_start = 0, cff_start = 3504, cff_length = 306553, encoding_start = 960, 
  vs_start = 0, gasp_start = 0, glyph_start = 0, glyph_length = 0, gdef_start = 0, gdef_length = 0, 
  gpos_start = 0, gpos_length = 0, gsub_start = 0, gsub_length = 0, g_bounds = 0, 
  bitmapdata_start = 0, bitmapdata_length = 0, bitmaploc_start = 0, bitmaploc_length = 0, 
  gvar_start = 0, gvar_len = 0, fvar_start = 0, fvar_len = 0, avar_start = 0, avar_len = 0, 
  cvar_start = 0, cvar_len = 0, head_start = 172, hhea_start = 228, hmetrics_start = 310088, 
  kern_start = 0, glyphlocations_start = 0, loca_length = 0, maxp_start = 264, maxp_len = 6, 
  copyright_start = 368, postscript_start = 3472, os2_start = 272, typ1_start = 0, typ1_length = 0, 
  vhea_start = 0, vmetrics_start = 0, vorg_start = 0, pfed_start = 0, tex_start = 0, bdf_start = 0, 
  fftm_start = 310060, prop_start = 0, lcar_start = 0, opbd_start = 0, acnt_start = 0, 
  feat_start = 0, mort_start = 0, morx_start = 0, bsln_start = 0, math_start = 0, math_length = 0, 
  cvt_start = 0, cvt_len = 0, prep_start = 0, prep_len = 0, fpgm_start = 0, fpgm_len = 0, 
  one_of_many = 0, obscomplain = 0, cmpcomplain = 0, unkcomplain = 0, comcomplain = 0, 
  onlystrikes = 0, onlyonestrike = 0, barecff = 0, platform = 0, specific = 0, 
  anchor_class_cnt = 0, anchor_merge_cnt = 0, ahead = 0x0, alast = 0x0, khead = 0x0, klast = 0x0, 
  vkhead = 0x0, vklast = 0x0, gpos_lookups = 0x0, gsub_lookups = 0x0, cur_lookups = 0x0, 
  mort_subs_lookup = 0x0, mort_pos_lookup2 = 0x0, mort_r2l = 0, mort_tag_mac = 0, mort_feat = 0, 
  mort_setting = 0, mort_is_nested = 0, morx_classes = 0x0, bsln_values = 0x0, mort_max = 0, 
  tabs = 0x0, possub = 0x0, sm = 0x0, features = 0x0, chosenname = 0x0, macstyle = 0, 
  lookup_cnt = 0, feature_cnt = 0, variations = 0x0, macstrids = 0x0, fd = 0x0, savecnt = 0, 
  savetab = 0x0, last_size_pos = 0, design_size = 0, fontstyle_id = 0, fontstyle_name = 0x0, 
  design_range_bottom = 0, design_range_top = 0, texdata = {type = tex_unset, params = {
      0 <repeats 22 times>}}, mark_class_cnt = 0, mark_classes = 0x0, mark_class_names = 0x0, 
  warned_morx_out_of_bounds_glyph = 0 '\0', badgid_cnt = 0, badgid_max = 0, badgids = 0x0, 
  creationtime = 1216823215, modificationtime = 1218308786, gasp_cnt = 0, gasp = 0x0, math = 0x0, 
  bad_ps_fontname = 0, bad_glyph_data = 0, bad_cff = 0, bad_metrics = 0, bad_cmap = 0, 
  bad_embedded_bitmap = 0, bad_gx = 0, bad_ot = 0, bad_os2_version = 0, bad_sfnt_header = 0, 
  guidelines = {background = 0, order2 = 0, anyflexes = 0, splines = 0x0, images = 0x0, refs = 0x0, 
    undoes = 0x0, redoes = 0x0, validation_state = 0, old_vs = 0}, horiz_base = 0x0, 
  vert_base = 0x0}
#17 0x002b8bf6 in _ReadSplineFont (file=0x8872330, 
    filename=0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf", openflags=0)
    at splinefont.c:1055
	ch2 = <value optimized out>
	ch4 = 79
	ch6 = 10
	ch10 = 130
	ch1 = 79
	ch3 = 84
	ch5 = 0
	ch7 = 0
	ch9 = 6
	sf = <value optimized out>
	ubuf = "Loading font from Boisik.otf\000¿\000°ú·jä\021", '\0' <repeats 26 times>, "°ú·kä\021", '\0' <repeats 85 times>, "Ô\220\021\000\000°ú·\000\000\000\000ÿÿÿÿÀß­\000Ô\220\021\000\000°ú·\220\210\234¿yó¬\000ž±ú·\000\000\000\000\001\000\000\000\001\000\000\000\000\000\000\000jä\021\000\000\020\021\000\210\226-\000\001\000\000\000Ô\220\021\000H\237>\000\000\000\000\000\000\000\000\000È\210\234¿àT­"
	temp = <value optimized out>
	fromsfd = 0
	i = <value optimized out>
	pt = 0x88af725 ".otf"
	strippedname = 0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf"
	tmpfile = 0x0
	fullname = 0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf"
	archivedir = 0x0
	len = <value optimized out>
	checked = 116
	compression = 0
	wasurl = 0
	nowlocal = 1
	wasarchived = 0
#18 0x002ba21c in ReadSplineFont (
    filename=0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf", openflags=0)
    at splinefont.c:1224
No locals.
#19 0x002ba309 in LoadSplineFont (
    filename=0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf", openflags=0)
    at splinefont.c:1297
	sf = (SplineFont *) 0x0
	pt = <value optimized out>
	ept = <value optimized out>
	tobefreed1 = 0x0
	tobefreed2 = 0x0
	extens = {0x3b2f3d ".sfd", 0x3aaeb8 ".pfa", 0x3aaec0 ".pfb", 0x3aae9e ".ttf", 
  0x3aaed6 ".otf", 0x36aa8d ".ps", 0x3aaecc ".cid", 0x3aae48 ".bin", 0x3aae3d ".dfont", 
  0x3b1e66 ".PFA", 0x3b1e6b ".PFB", 0x3b1e70 ".TTF", 0x3b1e75 ".OTF", 0x3b1e7a ".PS", 
  0x3b1e7e ".CID", 0x3b1e83 ".BIN", 0x3b1e88 ".DFONT", 0x0}
#20 0x0019ad7c in ViewPostscriptFont (
    filename=0x88af6f8 "/home/vdmo/Documents/Font Faces/Boisik/Boisik.otf", openflags=0)
    at fontviewbase.c:1234
	sf = <value optimized out>
#21 0x0810a9b4 in MenuOpen (base=0x0, mi=0x0, e=0x0) at fontview.c:1153
	temp = 0x8863060 "/home/vdmo/Documents/Font Faces/Boisik"
	file = 0x8863087 "Boisik.otf"
	test = <value optimized out>
	fvcnt = 0
	fvtest = <value optimized out>
#22 0x0819f3dc in main (argc=1, argv=0xbf9c9004) at startui.c:1191
	load_prefs = 0x0
	i = 5590599
	recover = 2
	any = 0
	next_recent = -1208311152
	pos = {x = 200, y = 200, width = 379, height = 319}
	wattrs = {mask = 590902, event_masks = 4294967293, border_width = 2, border_color = 9, 
  background_color = 16777215, cursor = ct_pointer, window_title = 0xad6a45, icon_title = 0x8, 
  icon = 0x4c, nodecoration = 0, positioned = 1, centered = 0, undercursor = 0, noresize = 0, 
  restrict_input_to_me = 1, redirect_chars_to_me = 1, is_dlg = 1, not_restricted = 1, 
  redirect_from = 0xb7faacf8, transient = 0xacdf67, utf8_window_title = 0x81bb50d "FontForge", 
  utf8_icon_title = 0xb7faacf8 "š²ú·Hµú·ð·ú·\220¢ú· ¥ú·\230ºú·0œú·"}
	display = 0x0
	rq = {family_name = 0x88abcd8, point_size = 12, weight = 400, style = fs_italic, 
  utf8_family_name = 0x0}
	ds = <value optimized out>
	ld = 0
	openflags = -1208309184
	doopen = 0
	quit_request = 0
	times = {116, 105, 109, 101, 115, 44, 99, 108, 101, 97, 114, 108, 121, 117, 44, 117, 110, 
  105, 102, 111, 110, 116, 0}
(gdb) quit

ok. Upstream has identified and fixed this (at least it works for me now)

Can you try the scratch build at: 
http://koji.fedoraproject.org/koji/taskinfo?taskID=1019271

and confirm it now works for you?

I'm going to go ahead and close this now, as the indicated build appears to fix things. 

Feel free to reopen if it's not working for you...