The FreeType Project - Bugs: bug #46107, four instances of signed integer...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46107: four instances of signed integer overflow in src/cff/cf2hints.c
Submitter: | Kostya Serebryany <kcc> | ||
Submitted: | Fri 02 Oct 2015 08:58:34 PM UTC | ||
Severity: | 3 - Normal | Item Group: | None |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.8.1 |
Jump to the original submission
Thu 01 Jun 2017 04:30:36 PM UTC, comment #10: |
Werner LEMBERG <wl> |
Wed 21 Oct 2015 12:00:33 PM UTC, comment #9: Dave provided a patch for the assertion issue, now applied to the git repository. |
Werner LEMBERG <wl> |
Mon 19 Oct 2015 04:58:42 AM UTC, comment #8: I plan to follow the advice given in https://savannah.nongnu.org/bugs/?46149#comment8 to resolve this issue (together with same macro voodoo in case this functionality is missing in the compiler). It's certainly a good idea to mark the places where overflow can happen without any harm.
|
Werner LEMBERG <wl> |
Thu 15 Oct 2015 11:44:09 PM UTC, comment #7: The original CFF hint engine was designed with a goal of small code size. This led to two principles: good fonts should render correctly and bad fonts should not crash. In other words, it is acceptable for a bad font to render badly without necessarily returning an error. The use of 32-bit integers to hold 16.16 fixed point numbers is widespread, and usually not checked because it is not used in computing addresses.
|
Dave Arnold <darnold> |
Wed 07 Oct 2015 01:24:28 AM UTC, comment #6: Note that in debug mode this actually triggers assertions,
|
Kostya Serebryany <kcc> |
Sun 04 Oct 2015 06:44:49 AM UTC, comment #5: I've tweaked the bot to ignore all ubsan warnings with "/cff/"
You know better.
|
Kostya Serebryany <kcc> |
Sat 03 Oct 2015 08:16:48 AM UTC, comment #4: Thanks. It will take some time until Dave can take care of it, I guess. On the other hand, all those overflows are harmless, AFAICS, so there is no pressure here.
|
Werner LEMBERG <wl> |
Sat 03 Oct 2015 02:23:53 AM UTC, comment #3: Assigning to David Arnold |
Alexei Podtelezhnikov <podtelez> |
Fri 02 Oct 2015 10:06:26 PM UTC, comment #2: More similar reports and more reproducers attached:
|
Kostya Serebryany <kcc> |
Fri 02 Oct 2015 10:00:56 PM UTC, comment #1: BTW, these can be found on the FreeType fuzzer bot:
|
Kostya Serebryany <kcc> |
Fri 02 Oct 2015 08:58:34 PM UTC, original submission:
found in fresh trunk with libFuzzer+UBSan
|
Kostya Serebryany <kcc> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 13 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2017-06-01 | wl | Status | Postponed | Fixed | |
Open/Closed | Open | Closed | |||
Planned Release | None | 2.8.1 | |||
2015-10-21 | wl | Status | None | Postponed | |
Assigned to | darnold | wl | |||
2015-10-03 | podtelez | Assigned to | None | darnold | |
2015-10-02 | kcc | Attached File | - | Added 75f9b7f04aaa0b9cf43f91e71ce8137ac29f2a9d, #35041 | |
Attached File | - | Added 4ad5cd343b880732b4786a9ec72ca47aa7e48637, #35042 | |||
Attached File | - | Added 3000354c56c0cab4062dd592e66fe9c01d1f2367, #35043 | |||
Attached File | - | Added 1e36938649bca9d56e29896f24a6ece6d7cd308b, #35044 | |||
2015-10-02 | kcc | Attached File | - | Added 41eb6739af9e5efd97f2452dead0dce7b0518487, #35038 | |
Attached File | - | Added 245da64fff1c92fdede5603d5ba2df5ed8283bd8, #35039 | |||
Attached File | - | Added 05c34d8f8ee9d4a627a02637595eba5a839c5058, #35040 |
Powered by Savane 3.13-d3ae.
Corresponding source code
I think I've fixed all of those overflows in git. Now waiting for the fuzzer to report more :-)