Bug 680419

Description of problem:

When running fonttosftn on a simple pcf file, the application segfaults.

[root@localhost ~]# fonttosfnt -v -o font.ttf 4x6.pcf 
4x6.pcf Fixed Regular: 1 sizes
Segmentation fault
[root@localhost ~]# 

Version-Release number of selected component (if applicable):

[root@localhost ~]# rpm -q xorg-x11-font-utils glibc
xorg-x11-font-utils-7.2-10.el6.x86_64
glibc-2.12-1.7.el6.x86_64

How reproducible:

Always on x86_64.  I haven't seen this behavior on i686.

Steps to Reproduce:
1. Run the above command
2.
3.
  
Actual results:

Segfault

Expected results:

No segfault

Additional info:

A stacktrace.

[root@localhost ~]# gdb fonttosfnt
GNU gdb (GDB) Red Hat Enterprise Linux (7.1-29.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/fonttosfnt...Reading symbols from /usr/lib/debug/usr/bin/fonttosfnt.debug...done.
done.
(gdb) set args -v -o font.ttf 4x6.pcf
(gdb) run
Starting program: /usr/bin/fonttosfnt -v -o font.ttf 4x6.pcf
4x6.pcf Fixed Regular: 1 sizes

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff737fff7 in _IO_vfprintf_internal (s=<value optimized out>, 
    format=<value optimized out>, ap=<value optimized out>) at vfprintf.c:1593
1593		  process_string_arg (((struct printf_spec *) NULL));
Missing separate debuginfos, use: debuginfo-install freetype-2.3.11-5.el6.x86_64 libfontenc-1.0.5-2.el6.x86_64 zlib-1.2.3-25.el6.x86_64
(gdb) bt
#0  0x00007ffff737fff7 in _IO_vfprintf_internal (s=<value optimized out>, 
    format=<value optimized out>, ap=<value optimized out>) at vfprintf.c:1593
#1  0x00007ffff7430850 in ___vsnprintf_chk (s=0x60e010 "", 
    maxlen=<value optimized out>, flags=1, slen=<value optimized out>, 
    format=0x40651a "%s X.org bitmap size %dx%d", args=0x7fffffffe330)
    at vsnprintf_chk.c:65
#2  0x00000000004037c3 in vsnprintf (f=0x40651a "%s X.org bitmap size %dx%d", 
    args=0x7fffffffe330) at /usr/include/bits/stdio2.h:78
#3  vsprintf_reliable (f=0x40651a "%s X.org bitmap size %dx%d", 
    args=0x7fffffffe330) at util.c:93
#4  0x00000000004038ab in sprintf_reliable (f=<value optimized out>)
    at util.c:77
#5  0x00000000004019aa in readFile (filename=0x7fffffffe882 "4x6.pcf", 
    font=0x608030) at read.c:130
#6  0x000000000040127c in main (argc=5, argv=<value optimized out>)
    at fonttosfnt.c:110
(gdb)