bugThe FreeType Project - Bugs: bug #46208, Small input takes a long time to...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46208: Small input takes a long time to hint when fuzzing.

Submitter:  bungeman <bungeman>
Submitted:  Wed 14 Oct 2015 06:29:43 PM UTC
   
 
Severity:  3 - Normal Item Group:  Wishlist
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Sat 17 Oct 2015 05:20:41 AM UTC, comment #3: 

I would brutally set the value to 10000 (making infinite bytecode loops exit 100 times faster) – it's not the job of a fuzzer to validate TrueType hinting, so a failing glyph doesn't matter.  Additionally, I estimate that 99.99% of all fonts don't need 10000 instructions in a single TT_RunIns run.

Werner LEMBERG <wl>
Group administrator
Fri 16 Oct 2015 02:20:05 PM UTC, comment #2: 

How would you suggest using TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES with the fuzzer?

Kostya Serebryany <kcc>
Group Member
Thu 15 Oct 2015 07:53:01 PM UTC, comment #1: 

I've added TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES to control this.

Thanks for the suggestion.

Werner LEMBERG <wl>
Group administrator
Wed 14 Oct 2015 06:29:43 PM UTC, original submission:  

The attached malformed font (4k in size) takes on the order of ten seconds to run through src/tools/ftfuzzer/runinput.cc . As opposed to other long running or high memory issues, this one does not appear to be due to cmaps but instead spends most of its time in the hinter. According to 'perf' the big time use is

73.05%
TT_RunIns
TT_Hint_Glyph
load_truetype_glyph
tt_glyph_load
FT_Load_Glyph
LLVMFuzzerTestOneInput

On closer inspection of the hotspots and setting some breakpoints, it looks like the fuzzer has discovered how to make infinite loops in the instructions and is running up to MAX_RUNNABLE_OPCODES.

It may speed fuzzing by making it possible to reduce MAX_RUNNABLE_OPCODES from 1,000,000 in fuzzer builds.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kcc (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by bungeman (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-15 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-14 bungeman Attached File- Added slow-unit-ef54d091c70d557f2d14aec35b27b27d0916a8a3, #35196

    Back to the top

    Powered by Savane 3.14-9aa3.
    Corresponding source code