external/freetype: nullptr-with-offset

...as seen during CppunitTest_xmloff_style,

> workdir/UnpackedTarball/freetype/src/truetype/ttgxvar.c:1048:31: runtime error: applying zero offset to null pointer
>  #0 in tt_var_get_item_delta at workdir/UnpackedTarball/freetype/src/truetype/ttgxvar.c:1048:31
>  #1 in tt_hvadvance_adjust at workdir/UnpackedTarball/freetype/src/truetype/ttgxvar.c:1242:13
>  #2 in tt_vadvance_adjust at workdir/UnpackedTarball/freetype/src/truetype/ttgxvar.c:1278:12
>  #3 in tt_face_get_metrics at workdir/UnpackedTarball/freetype/src/sfnt/ttmtx.c:319:11
>  #4 in cff_slot_load at workdir/UnpackedTarball/freetype/src/cff/cffgload.c:660:11
>  #5 in cff_glyph_load at workdir/UnpackedTarball/freetype/src/cff/cffdrivr.c:192:13
>  #6 in FT_Load_Glyph at workdir/UnpackedTarball/freetype/src/base/ftobjs.c:1066:15
>  #7 in _cairo_ft_scaled_glyph_load_glyph at workdir/UnpackedTarball/cairo/src/cairo-ft-font.c:2455:13
>  #8 in _cairo_ft_scaled_glyph_init at workdir/UnpackedTarball/cairo/src/cairo-ft-font.c:2640:11
>  #9 in _cairo_scaled_glyph_lookup at workdir/UnpackedTarball/cairo/src/cairo-scaled-font.c:3035:6
>  #10 in _cairo_scaled_font_glyph_device_extents at workdir/UnpackedTarball/cairo/src/cairo-scaled-font.c:2250:15
>  #11 in _cairo_composite_rectangles_init_for_glyphs at workdir/UnpackedTarball/cairo/src/cairo-composite-rectangles.c:476:14
>  #12 in _cairo_compositor_glyphs at workdir/UnpackedTarball/cairo/src/cairo-compositor.c:280:14
>  #13 in _cairo_image_surface_glyphs at workdir/UnpackedTarball/cairo/src/cairo-image-surface.c:1030:12
>  #14 in _cairo_surface_show_text_glyphs at workdir/UnpackedTarball/cairo/src/cairo-surface.c:2920:15
>  #15 in _cairo_gstate_show_text_glyphs at workdir/UnpackedTarball/cairo/src/cairo-gstate.c:2077:15
>  #16 in _cairo_default_context_glyphs at workdir/UnpackedTarball/cairo/src/cairo-default-context.c:1334:12
>  #17 in cairo_show_glyphs at workdir/UnpackedTarball/cairo/src/cairo.c:3670:14
>  #18 in CairoTextRender::DrawTextLayout(GenericSalLayout const&, SalGraphics const&) at vcl/unx/generic/gdi/cairotextrender.cxx:477:9
>  #19 in SvpSalGraphics::DrawTextLayout(GenericSalLayout const&) at vcl/headless/svptext.cxx:72:23
>  #20 in GenericSalLayout::DrawText(SalGraphics&) const at vcl/source/gdi/CommonSalLayout.cxx:171:18
>  #21 in OutputDevice::ImplDrawTextDirect(SalLayout&, bool) at vcl/source/outdev/text.cxx:312:16
>  #22 in OutputDevice::ImplDrawText(SalLayout&) at vcl/source/outdev/text.cxx:463:9
>  #23 in OutputDevice::DrawTextArray(Point const&, rtl::OUString const&, KernArraySpan, std::span<unsigned char const, 18446744073709551615ul>, int, int, SalLayoutFlags, SalLayoutGlyphs const*) at vcl/source/outdev/text.cxx:701:9
>  #24 in SwFntObj::DrawText(SwDrawTextInfo&) at sw/source/core/txtnode/fntcache.cxx:1490:31
>  #25 in SwSubFont::DrawText_(SwDrawTextInfo&, bool) at sw/source/core/txtnode/swfont.cxx:1144:24
>  #26 in SwFont::DrawText_(SwDrawTextInfo&) at sw/source/core/inc/swfont.hxx:324:29
>  #27 in SwTextPaintInfo::DrawText_(rtl::OUString const&, SwLinePortion const&, o3tl::strong_int<int, Tag_TextFrameIndex>, o3tl::strong_int<int, Tag_TextFrameIndex>, bool, bool, bool, bool) at sw/source/core/text/inftxt.cxx:730:21
>  #28 in SwTextPaintInfo::DrawText(SwLinePortion const&, o3tl::strong_int<int, Tag_TextFrameIndex>, bool) const at sw/source/core/text/inftxt.hxx:783:41
>  #29 in SwTextPortion::Paint(SwTextPaintInfo const&) const at sw/source/core/text/portxt.cxx:603:18
>  #30 in SwTextPainter::DrawTextLine(SwRect const&, SwSaveClip&, bool, std::optional<SwTaggedPDFHelper>&, std::optional<SwTaggedPDFHelper>&, bool) at sw/source/core/text/itrpaint.cxx:433:23
>  #31 in SwTextFrame::PaintSwFrame(OutputDevice&, SwRect const&) const at sw/source/core/text/frmpaint.cxx:787:23
>  #32 in SwLayoutFrame::PaintSwFrame(OutputDevice&, SwRect const&) const at sw/source/core/layout/paintfrm.cxx:3804:21
>  #33 in SwFlyFrame::PaintSwFrame(OutputDevice&, SwRect const&) const at sw/source/core/layout/paintfrm.cxx:4507:20
>  #34 in SwVirtFlyDrawObj::wrap_DoPaintObject(drawinglayer::geometry::ViewInformation2D const&) const at sw/source/core/draw/dflyobj.cxx:541:18
>  #35 in drawinglayer::primitive2d::(anonymous namespace)::SwVirtFlyDrawObjPrimitive::get2DDecomposition(drawinglayer::primitive2d::Primitive2DDecompositionVisitor&, drawinglayer::geometry::ViewInformation2D const&) const at sw/source/core/draw/dflyobj.cxx:244:35
>  #36 in drawinglayer::processor2d::BaseProcessor2D::process(drawinglayer::primitive2d::BasePrimitive2D const&) at drawinglayer/source/processor2d/baseprocessor2d.cxx:46:24
>  #37 in drawinglayer::processor2d::VclPixelProcessor2D::processBasePrimitive2D(drawinglayer::primitive2d::BasePrimitive2D const&) at drawinglayer/source/processor2d/vclpixelprocessor2d.cxx:397:13
>  #38 in drawinglayer::processor2d::BaseProcessor2D::process(drawinglayer::primitive2d::Primitive2DContainer const&) at drawinglayer/source/processor2d/baseprocessor2d.cxx:69:21
>  #39 in sdr::contact::ObjectContactOfPageView::DoProcessDisplay(sdr::contact::DisplayInfo&) at svx/source/sdr/contact/objectcontactofpageview.cxx:284:31
>  #40 in sdr::contact::ObjectContactOfPageView::ProcessDisplay(sdr::contact::DisplayInfo&) at svx/source/sdr/contact/objectcontactofpageview.cxx:120:21
>  #41 in SdrPageWindow::RedrawLayer(o3tl::strong_int<short, SdrLayerIDTag> const*, sdr::contact::ViewObjectContactRedirector*, basegfx::B2IRange const*) at svx/source/svdraw/sdrpagewindow.cxx:421:28
>  #42 in SdrPageView::DrawLayer(o3tl::strong_int<short, SdrLayerIDTag>, OutputDevice*, sdr::contact::ViewObjectContactRedirector*, tools::Rectangle const&, basegfx::B2IRange const*) at svx/source/svdraw/svdpagv.cxx:265:27
>  #43 in SwViewShellImp::PaintLayer(o3tl::strong_int<short, SdrLayerIDTag>, SwPageFrame const&, SwRect const&, Color const*, bool, sdr::contact::ViewObjectContactRedirector*) at sw/source/core/view/vdraw.cxx:139:20
>  #44 in SwRootFrame::PaintSwFrame(OutputDevice&, SwRect const&) const at sw/source/core/layout/paintfrm.cxx:3527:33
>  #45 in SwViewShell::PrtOle2(SwDoc*, SwViewOption const*, SwPrintData const&, OutputDevice&, tools::Rectangle const&, bool) at sw/source/core/view/vprint.cxx:592:27
>  #46 in SwDocShell::Draw(OutputDevice*, JobSetup const&, unsigned short, bool) at sw/source/uibase/app/docsh.cxx:881:5
>  #47 in SfxObjectShell::DoDraw_Impl(OutputDevice*, Point const&, Fraction const&, Fraction const&, JobSetup const&, unsigned short, bool) at sfx2/source/doc/objembed.cxx:204:5
>  #48 in SfxObjectShell::DoDraw(OutputDevice*, Point const&, Size const&, JobSetup const&, unsigned short, bool) at sfx2/source/doc/objembed.cxx:151:9
>  #49 in SfxObjectShell::CreatePreview_Impl(bool, VirtualDevice*, GDIMetaFile*) const at sfx2/source/doc/objcont.cxx:198:40
>  #50 in SfxObjectShell::GetPreviewBitmap() const at sfx2/source/doc/objcont.cxx:110:9
>  #51 in SfxObjectShell::WriteThumbnail(bool, com::sun::star::uno::Reference<com::sun::star::io::XStream> const&) at sfx2/source/doc/objstor.cxx:3850:31
>  #52 in SfxObjectShell::GenerateAndStoreThumbnail(bool, com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&) at sfx2/source/doc/objstor.cxx:3808:33
>  #53 in SfxObjectShell::SaveTo_Impl(SfxMedium&, SfxItemSet const*) at sfx2/source/doc/objstor.cxx:1531:19
>  #54 in SfxObjectShell::PreDoSaveAs_Impl(rtl::OUString const&, rtl::OUString const&, SfxItemSet const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) at sfx2/source/doc/objstor.cxx:3117:39
>  #55 in SfxObjectShell::CommonSaveAs_Impl(INetURLObject const&, rtl::OUString const&, SfxItemSet&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) at sfx2/source/doc/objstor.cxx:2907:9
>  #56 in SfxObjectShell::APISaveAs_Impl(std::basic_string_view<char16_t, std::char_traits<char16_t>>, SfxItemSet&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) at sfx2/source/doc/objserv.cxx:320:19
>  #57 in SfxBaseModel::impl_store(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, bool) at sfx2/source/doc/sfxbasemodel.cxx:3233:42
>  #58 in SfxBaseModel::storeToURL(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) at sfx2/source/doc/sfxbasemodel.cxx:1815:13
>  #59 in UnoApiTest::saveWithParams(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) at test/source/unoapi_test.cxx:213:16
>  #60 in UnoApiTest::save(rtl::OUString const&, char const*) at test/source/unoapi_test.cxx:178:5
>  #61 in testWritingModeBTLR::TestBody() at xmloff/qa/unit/style.cxx:193:9

Change-Id: I54d4d90e203127e018b99c34785602ac3d96e425
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163925
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>

1 files changed, 11 insertions, 0 deletions

diff --git a/external/freetype/ubsan.patch b/external/freetype/ubsan.patch
index 80446ac5c89c..43ce217c4b7d 100644
--- a/external/freetype/ubsan.patch
+++ b/external/freetype/ubsan.patch
@@ -10,3 +10,14 @@
  
      table->cursor += length;
      return FT_Err_Ok;
+--- src/truetype/ttgxvar.c
++++ src/truetype/ttgxvar.c
+@@ -1045,7 +1045,7 @@
+     if ( varData->longWords )
+       per_region_size *= 2;
+ 
+-    bytes = varData->deltaSet + per_region_size * innerIndex;
++    bytes = varData->deltaSet ? varData->deltaSet + per_region_size * innerIndex : NULL;
+ 
+     if ( varData->longWords )
+     {