bugThe FreeType Project - Bugs: bug #25597, crash when parsing cff real with...

 
 

bug #25597: crash when parsing cff real with too much significant digits

Submitted by:  bram tassyns <bramt>
Submitted on:  Mon 16 Feb 2009 08:37:00 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.9

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 11 Mar 2009 10:23:46 AM UTC, comment #7:

Thanks, I now can see the problem.

I've applied your patch.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 10 Mar 2009 07:54:30 AM UTC, comment #6:

The program crashes because you use a too big index for power_tens. I suspect the floating point exception is triggered because of whatever is present after the power_tens array. This is compiler/platform dependant, so it's possible you don't get this error/crash.
If you really want to check the issue try using an assert to check the index you pass to power_tens and you'll see it goes over the limit.

bram tassyns <bramt>
Mon 09 Mar 2009 06:07:25 PM UTC, comment #5:

Floating point exception? FreeType doesn't use floating point
numbers at all!

This smells very fishy. Can you try a different compiler or
use a different optimization level?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 09 Mar 2009 02:46:46 PM UTC, comment #4:

Strange, when I use ftview 12 <attached file> I get a message "Floating point exception" and the application quits. I'm running on an intel mac with MacOSX 10.5.5 installed. After applying the patch everything works fine.

bram tassyns <bramt>
Mon 02 Mar 2009 07:30:10 PM UTC, comment #3:

I can't repeat the crash. Both valgrind and gdb don't report
an error or warning while using ftview.

Can you post a recipe to induce the crash?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 25 Feb 2009 09:18:55 AM UTC, comment #2:

Attached font sample.

bram tassyns <bramt>
Tue 17 Feb 2009 05:24:31 PM UTC, comment #1:

Please post the problematic font (or send it to me privately).

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 16 Feb 2009 08:37:00 AM UTC, original submission:

Right now the cff parsing crashes when passing a number with more then 10 significant fraction digits. The reason is that the power_tens[...] expects the number to have less then 10 digits (you can't represent 10^10 in a 32 bit integer). I believe it's safe to ignore the last significant digits if a fraction contains more then 9 significant fraction digits.

In cffparse.c, cff_parse_real, line 247

/* Skip leading zeros if possible. */
if ( !nib && !number )
exponent_add--;
/* Only add digit if we don't overflow. */
else if ( number < 0xCCCCCCCL )
{
fraction_length++;
number = number * 10 + nib;
}

should become

/* Skip leading zeros if possible. */
if ( !nib && !number )
exponent_add--;
/* Only add digit if we don't overflow. */
else if ( number < 0xCCCCCCCL
&& fraction_length < 9 )
{
fraction_length++;
number = number * 10 + nib;
}
}

bram tassyns <bramt>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #17527:  AdobeSerifMM.cff added by bramt (34KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bramt (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 11 Mar 2009 10:23:46 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.9
    Wed 25 Feb 2009 09:18:36 AM UTCbramtAttached File-=>Added AdobeSerifMM.cff, #17527
    Tue 17 Feb 2009 05:24:31 PM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl

    Back to the top


    Powered by Savane 3.1-cleanup1