Skip to content

[sfnt] Fix crash in Load_SBit_Png on Windows x64

Jesse Towner requested to merge jwtowner/freetype:master into master

This merge request fixes issue #1037 (closed) describing a crash that occurs in Load_SBit_Png when running on a 64-bit Windows OS. A memory access violation exception would be raised by setjmp if the jmp_buf is not aligned to a 16-byte memory boundary. This is due to setjmp executing movdqa instructions to store 128-bit XMM registers to memory, which require correct memory alignment. This problem occurs because png_create_read_struct uses malloc and free for memory management, which only guarantees 8-byte alignment on Windows.

Instead, to fix the problem, png_create_read_struct_2 is used on 64-bit Windows, which allows for user-defined memory allocation and deallocation callbacks to be specified. These callbacks forward the allocation and deallocation requests to _aligned_alloc and _aligned_free, ensuring that the allocated png_struct and internal jmp_buf have the requisite 16-byte alignment.

Thanks!

Merge request reports