QT access violation on www.utk.edu (opentype font QT 5.10)

[gzhangx]

All other website are fine except www.utk.edu, access violation. (QT 5.1 msvc2012 opengl)
I have read the opentype font solved problem, but this one seems to be different.

After some debugging, what happened is it has a embedded css font, the font might be corrupt. In Qt5.1.0\5.1.0\Src\qtbase\src\plugins\platforms\windows\qwindowsfontdatabase.cpp, in function
TableDirectory *EmbeddedFont::tableDirectoryEntry(const QByteArray &tagName), offsetSubTable->numTables is big and the loop run out of allocated memory boundries.

Would suggest check the boundry against m_fontData length for corrupted fonts.

I am trying to fix that myself, but the build got unresolved on Accessability2_fileinfo stuff.

Font info:
http://use.typekit.net/c/4e3f72/superclarendon-1:i4:i7:n4:n7.NHW:H:2,NHc:H:2,NHX:H:2,NHb:H:2/d?3bb2a6e53c9684ffdc9a9bf4195b2a62ac2abccc2253da0ff4783ecd49ac5a636141299d185b43bea23c72aab21599192ea9f07951e62538a1fc023b50dc182e3216e6d9fe328797369d99cbc346f05b193742cd860fdceea40496e94e111dcafc64f2adfa7565a4a61c308a9fefe7ae6046fa1f02a1a46e964b0a (if you open the site, search for superclarendon, the link should have expired by the time you read this).

Stack trace below.

qwindowsd.dll!anonymous namespace'::EmbeddedFont::tableDirectoryEntry(const QByteArray & tagName) Line 172 C++ qwindowsd.dll!anonymous namespace'::EmbeddedFont::changeFamilyName(const QString & newFamilyName) Line 215 C++
qwindowsd.dll!QWindowsFontDatabase::fontEngine(const QByteArray & fontData, double pixelSize, QFont::HintingPreference hintingPreference) Line 1077 C++
Qt5Guid.dll!QRawFontPrivate::platformLoadFromData(const QByteArray & fontData, double pixelSize, QFont::HintingPreference hintingPreference) Line 63 C++
Qt5Guid.dll!QRawFont::loadFromData(const QByteArray & fontData, double pixelSize, QFont::HintingPreference hintingPreference) Line 256 C++
Qt5Guid.dll!QRawFont::QRawFont(const QByteArray & fontData, double pixelSize, QFont::HintingPreference hintingPreference) Line 178 C++
Qt5WebKitd.dll!WebCore::createFontCustomPlatformData(WebCore::SharedBuffer * buffer) Line 66 C++
Qt5WebKitd.dll!WebCore::CachedFont::ensureCustomFontData() Line 110 C++
Qt5WebKitd.dll!WebCore::CSSFontFaceSource::getFontData(const WebCore::FontDescription & fontDescription, bool syntheticBold, bool syntheticItalic, WebCore::CSSFontSelector * fontSelector) Line 164 C++
Qt5WebKitd.dll!WebCore::CSSFontFace::getFontData(const WebCore::FontDescription & fontDescription, bool syntheticBold, bool syntheticItalic) Line 105 C++
Qt5WebKitd.dll!WebCore::CSSSegmentedFontFace::getFontData(const WebCore::FontDescription & fontDescription) Line 127 C++
Qt5WebKitd.dll!WebCore::CSSFontSelector::getFontData(const WebCore::FontDescription & fontDescription, const WTF::AtomicString & familyName) Line 539 C++
Qt5WebKitd.dll!WebCore::FontCache::getFontData(const WebCore::Font & font, int & familyIndex, WebCore::FontSelector * fontSelector) Line 475 C++
Qt5WebKitd.dll!WebCore::FontFallbackList::fontDataAt(const WebCore::Font * font, unsigned int realizedFontIndex) Line 108 C++
Qt5WebKitd.dll!WebCore::FontFallbackList::primaryFontData(const WebCore::Font * f) Line 96 C++
Qt5WebKitd.dll!WebCore::FontFallbackList::determinePitch(const WebCore::Font * font) Line 79 C++
Qt5WebKitd.dll!WebCore::FontFallbackList::isFixedPitch(const WebCore::Font * f) Line 73 C++
Qt5WebKitd.dll!WebCore::Font::isFixedPitch() Line 334 C++
Qt5WebKitd.dll!WebCore::RenderBlock::LineBreaker::nextLineBreak(WebCore::BidiResolverWebCore::InlineIterator,WebCore::BidiRun & resolver, WebCore::LineInfo & lineInfo, WebCore::RenderBlock::RenderTextInfo & renderTextInfo, WebCore::RenderBlock::FloatingObject * lastFloatFromPreviousLine, unsigned int consecutiveHyphenatedLines, WTF::VectorWebCore::WordMeasurement,64 & wordMeasurements) Line 2544 C++
Qt5WebKitd.dll!WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState & layoutState, WebCore::BidiResolverWebCore::InlineIterator,WebCore::BidiRun & resolver, const WebCore::InlineIterator & cleanLineStart, const WebCore::BidiStatus & cleanLineBidiStatus, unsigned int consecutiveHyphenatedLines) Line 1438 C++
Qt5WebKitd.dll!WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState & layoutState, bool hasInlineChild) Line 1370 C++
Qt5WebKitd.dll!WebCore::RenderBlock::layoutInlineChildren(bool relayoutChildren, WebCore::LayoutUnit & repaintLogicalTop, WebCore::LayoutUnit & repaintLogicalBottom) Line 1718 C++
Qt5WebKitd.dll!WebCore::RenderBlock::layoutBlock(bool relayoutChildren, WebCore::LayoutUnit pageLogicalHeight) Line 1563 C++
Qt5WebKitd.dll!WebCore::RenderBlock::layout() Line 1394 C++

[gzhangx]

Update, the font is a WOFF font, web open font format, looks like QT doesn't support it. However it should not assume it is a true type font and access violation on it. A simple fix would be to check if the font identifier is not true type, just return null instead of accessing memory according to true type structure.

[chuyi]

I built my qt 5 using 5.2.1. (qt from git, qtbase submodule commit hash: c466f2ed464a06ac6427df6135d3e905011aa50e).

I did not get exception on www.utk.edu.

But I got the same exception on www. staples.com.

Need help on fixing it.