Fri 18 Sep 2015 06:59:05 PM UTC, comment #2:
#0 FT_Stream_EnterFrame (stream=stream@entry=0x16a0b90, count=1812070520) at src/base/ftstream.c:236
error = <optimized out>
read_bytes = <optimized out>
#1 0x000000000041a3a8 in tt_face_load_cvt (face=face@entry=0x16a0bf0, stream=stream@entry=0x16a0b90) at src/truetype/ttpload.c:309
error = <optimized out>
memory = 0x16a0010
table_len = 1812070521
#2 0x000000000041b6df in tt_face_init (stream=0x16a0b90, ttface=<optimized out>, face_index=<optimized out>, num_params=<optimized out>, params=<optimized out>)
at src/truetype/ttobjs.c:585
error = <optimized out>
library = <optimized out>
sfnt = <optimized out>
face = <optimized out>
#3 0x0000000000410c32 in open_face (driver=driver@entry=0x16a01c0, astream=astream@entry=0x7fffffffdb58, external_stream=external_stream@entry=0 '\000', face_index=face_index@entry=0,
num_params=0, params=0x0, aface=aface@entry=0x7fffffffdb60) at src/base/ftobjs.c:1166
memory = 0x16a0010
clazz = 0x46fe20 <tt_driver_class>
face = 0x16a0bf0
internal = 0x16a1120
error = 0
error2 = <optimized out>
#4 0x00000000004113ab in FT_Open_Face (library=0x16a0040, args=args@entry=0x7fffffffdd50, face_index=<optimized out>, aface=0x7fffffffdda8)
at src/base/ftobjs.c:2157
num_params = <optimized out>
params = <optimized out>
error = 11
driver = 0x16a01c0
memory = 0x16a0010
stream = 0x16a0b90
face = 0x0
node = 0x0
external_stream = 0 '\000'
cur = 0x16a0058
limit = <optimized out>
#5 0x0000000000412234 in FT_New_Memory_Face (library=<optimized out>, file_base=<optimized out>, file_size=<optimized out>, face_index=<optimized out>, aface=<optimized out>)
at src/base/ftobjs.c:1256
args = {flags = 1, memory_base = 0x16a0980 "", memory_size = 512, pathname = 0x7fffffffde10 "", stream = 0x0, driver = 0x7ffff7df0515 <_dl_runtime_resolve+53>, num_params = 23726464,
params = 0x7ffff752f760 <main_arena>}
|
Thu 17 Sep 2015 04:00:10 AM UTC, original submission:
.. and it probably shouldn't.
Not sure if you treat this as a bug, but at the very least it hurts fuzzing.
I've got more cases where it consumes 3Gb+, 4Gb+ and so on,
I'll report those once this bug is fixed (and if they are still there)
Found with libFuzzer.
Feed the input below to FT_New_Memory_Face,
it will consume 1.7 Gb RAM and 2+ seconds of CPU time.
FT_Stream_EnterFrame: invalid i/o; pos = 0x1fc, count = 16, size = 0x200
FT_Stream_EnterFrame: invalid i/o; pos = 0x100, count = 1812070520, size = 0x200
2.23user 2.36system 0:04.62elapsed 99%CPU (0avgtext+0avgdata 1770892maxresident)k
0inputs+0outputs (0major+3252minor)pagefaults 0swaps
AAEAAABbAIAAAwCoOlMvMoLSlpwAAAE4AAAAYGNtYXBpIBkAAAABoAAAAEBjdnQgABQAAAAAAeAA
AAAAZ2x5Zn4+fDwAAAHsAAAAamhlYWTcx2BBAAAAvAAAADZoaGVhhAO+BAAAAPQAAABkaG10eFoA
QAYAAAGYAAAACGxvY2EwAAAAAAAB5AAAAAZtYXhwfAEBDwAAAhgAACogbmFtZX1wKfndAAACWIwA
AAFNc2IAAQAAAAsAgAADAKhPUy8ygtKWnAAAATgAAABgY21hcGkAGQAAAAGgAAAAQGN2dCAAFAAA
AAABAGwCAHln4ABpeI9+WpgAAEPEAAAAQAABAAAAAQAAlrW58l8PPPUACQPoAAAAAMfDi3AAAAAA
x9FaEABaAAACxgMgAAAACQACZn4+fDwAAAHsAAAAamhlYWTdx2BBAAAAvAAAADZoaGVhhAO+BAAA
APQAAAAkaG10eFoAQAYAAAGYAAAACGxvY2ExAAAAAAAAAAAAAAAAAQAA7gkg/wIDBgAAAABaAsYA
AQAAAAAAAAAAAAAAAAAAAAIAAAIAAAEACAACAAAAAAABAAAAAAAKAAACAAFzAAAAAAADAxoBkAAF
AAQCvAKKAPsAjQK8AooAAAHkAAAABm1heHB8AQ8CAAABGAAAACBuYW1lfXD53QAAAlgAAAFsc2I=
|