Thu 01 Jun 2017 04:30:36 PM UTC, comment #10:
I think I've fixed all of those overflows in git. Now waiting for the fuzzer to report more :-)
|
Wed 21 Oct 2015 12:00:33 PM UTC, comment #9:
Dave provided a patch for the assertion issue, now applied to the git repository.
|
Mon 19 Oct 2015 04:58:42 AM UTC, comment #8:
I plan to follow the advice given in https://savannah.nongnu.org/bugs/?46149#comment8 to resolve this issue (together with same macro voodoo in case this functionality is missing in the compiler). It's certainly a good idea to mark the places where overflow can happen without any harm.
In other words, no action is currently necessary for the overflow stuff. There's no pressure, and as soon as the infrastructure is implemented, it should be straightforward to convert the affected operations.
|
Thu 15 Oct 2015 11:44:09 PM UTC, comment #7:
The original CFF hint engine was designed with a goal of small code size. This led to two principles: good fonts should render correctly and bad fonts should not crash. In other words, it is acceptable for a bad font to render badly without necessarily returning an error. The use of 32-bit integers to hold 16.16 fixed point numbers is widespread, and usually not checked because it is not used in computing addresses.
It would be quite a bit of work (and code) to test and avoid all fixed point overflow. What would be gained?
I think the assertion is a separate issue, and should be removed and handled as an error.
|
Wed 07 Oct 2015 01:24:28 AM UTC, comment #6:
Note that in debug mode this actually triggers assertions,
i.e. prevents us from fuzzing in debug mode.
cff_index_get_pointers: invalid first offset value 12 set to zero
assertion failed on line 591 of file src/cff/cf2hints.c
|
Sun 04 Oct 2015 06:44:49 AM UTC, comment #5:
I've tweaked the bot to ignore all ubsan warnings with "/cff/"
>> all those overflows are harmless,
You know better.
Strictly speaking, any signed int overflow is undefined behavior,
and as such can not be harmless. But yes, there are different
levels of "harmful".
|
Sat 03 Oct 2015 08:16:48 AM UTC, comment #4:
Thanks. It will take some time until Dave can take care of it, I guess. On the other hand, all those overflows are harmless, AFAICS, so there is no pressure here.
|
Sat 03 Oct 2015 02:23:53 AM UTC, comment #3:
Assigning to David Arnold
|
Fri 02 Oct 2015 10:06:26 PM UTC, comment #2:
More similar reports and more reproducers attached:
src/cff/cf2blues.c:197:56: runtime error: signed integer overflow: 2145648640 - -19070976 cannot be represented in type 'int'
src/cff/cf2intrp.c:694:20: runtime error: signed integer overflow: 1869742080 + 1702100992 cannot be represented in type 'int'
src/cff/cf2intrp.c:310:20: runtime error: signed integer overflow: 1620651313 + 556606753 cannot be represented in type 'int'
src/cff/cf2font.c:401:41: runtime error: signed integer overflow: 2 * 2063925248 cannot be represented in type 'int'
(file #35041, file #35042, file #35043, file #35044)
|
Fri 02 Oct 2015 10:00:56 PM UTC, comment #1:
BTW, these can be found on the FreeType fuzzer bot:
https://github.com/kcc/libfuzzer-example/wiki/FreeType-Fuzzer-Bot
the bot does not properly report reproducers for ubsan
errors because the ubsan errors are not made fatal
for which I'll need to use -fno-sanitize-recover=signed-integer-overflow,shift. And I can't make them fatal before the existing errors are fix, because otherwise the bot will be useless. :)
|
Fri 02 Oct 2015 08:58:34 PM UTC, original submission:
found in fresh trunk with libFuzzer+UBSan
on this target function:
https://github.com/kcc/libfuzzer-example/blob/master/freetype-experiment/freetype2_fuzzer.cc
attached 3 reproducers that together lead to 4 reports:
src/cff/cf2hints.c:1476:21: runtime error: signed integer overflow: 2 * 1915551744 cannot be represented in type 'int'
src/cff/cf2hints.c:1501:22: runtime error: signed integer overflow: -2 * -1864433664 cannot be represented in type 'int'
src/cff/cf2hints.c:639:60: runtime error: signed integer overflow: 1986405665 + 1978017057 cannot be represented in type 'int'
src/cff/cf2hints.c:1554:23: runtime error: signed integer overflow: -2 * -1653473280 cannot be represented in type 'int'
|