bugThe FreeType Project - Bugs: bug #46118, src/base/ftglyph.c:407:40: runtime...

 
 

bug #46118: src/base/ftglyph.c:407:40: runtime error: left shift of negative value -32768

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Sun 04 Oct 2015 06:24:04 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 04 Oct 2015 11:08:22 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 04 Oct 2015 06:24:04 AM UTC, original submission:

found with libFuzzer+ubsan on fresh git

src/base/ftglyph.c:407:40: runtime error: left shift of negative value -32768

Af8IAQEBBAIAAQEBFkZGUVBJUistLWZvFXQ1OTA0MDYtLQABAQFG+Bv4FCgMHvgdAfgeAG8MA4sM
BDsdBYjcCvwFiNwHix0ATEopHQBMSgYOHFp6DCP3uzsiHAkSDCQcAScRHAEODCUeAOcPAAUBDVMI
AV1xOm91bmRlclBLVUUyQ29weXJpZ2h0KEMpIDE5OTUtOTE5NiBGb3VuZGVyIEdyb3VwIEMvcnBv
cjx0aW9uLiBBbGwgcme+dHMgcmVzj2VydmVkLkVaSC0tUEsxODdBQStBWkEtRUFIQQRQSzc0ODIw
NAAAAPAA8gD4AP8pAgEDAQ4BEAERARIBEwEUAxUqARYBGQEbARwBIAEhAAEiAQEIASi3CicAAAH/
CgMoIQGzQCcAAADQAQifwymPKKcqKAmLAW00KAH/CAEBAAQCAAEBJSFQUy0JZG9iZUZvbnQtMS4w
OiBHTlUtTGlseVBvbmQtZmV0YS1udW1tZXItMTMgMDAwCk0uMTAxJSVUaXQqbGU6IEdOVS1MaWx5
UG9uZC1mZXRhLW51bW1lci0xMgolJUNyZWFpb25hdGU6IFRodSBBcHIgKTE1IDEzOjAzOjM4IDIw
MDQKJTslQ3JlYXRvciByOm9vdAolJURvY3VtZW50U3VwcAH/CAEotwonAAEBAAEAAAEBKCcpIB0q
BCfwuik3YikvKgwHLCgK4KESKAonKiA3bGllZFJlc291cmNlczogZm50JSFGb250VHlwZTItMS4x
IEhncnNoZXktJSFGb250VHlwZTExMS0uOiBIZYABgAFLGiUhUFMtVHJ1ZVR5cGVGb250CiUleXBl
U3Npb246IDMuOjAzQTQzIDIwMT4KJSUhUFOJLVRydWVUeXBlbyUlIVBTLUFkb2JlRm9udDEwOiBD
Li1vdXJpZXItSWFsaWMgMDAxLjAwMwolJUNyZWF0aW9uRGF0ZTogVHVlIFNlcCAxNyAxNjozMDow
MiAxOTkxCiUlVk11c2FnZTogNTs2Njc1IDc1NTk5CiUlIkNvcHlyaWdodCBJbnRlcm5hdGlvbmFs
IEJ1c2luZXNzIE1hY2hpbmVzLENvcnAuIDE5OTEKJSUgSUJNIENvdXJpZXIgaXMgYSBUcmFkZW1h
cmsgb2YgdGhlIElCTSBDb3Jwb3JhdGlvbi4KMCUhRm9udFR5cGUxLTEuMTogSGc0ICFpYyAAACUh
UFMtJSFGb250JSFGb250VCBHTlUtTGlseVBvbgJkAC1mZXQTLXVtbWVyLTEzCiUgR2VuZXJhdGVk
IEZyb20gTWV0YUZvbnQgYml0bWFwIGJ5IG1mdHJhY2UgMS4wLjE5LCBodHRwOi8vd3d3LmNzLnV1
Lm5sLwolIEdlbmVyYXRlZCBieSBQZmFFZGl0IDEuMCAoaHR0cDovL3lwZTEtLjE6IEhlcnNoZXkt
UGxhaW4tRHVwbGV4LUl0YWxpYw0lIUZvbnQlIVBTLUFkb2JlRm9udC0xT1RUTyUhUFMtVHJ1ZVR5
cEZvbnQKJSV5cGVTc2lvbjsgMy46MDNBNDMgMjAxMAolJUNyZWF0b3I6IFJvYm9udE5hbWUgLyBk
ZWYKIGNlbnQgcHUgIGR1cCAzOC9hbXBlcnNhbmQgcHV0CiAgICBkdXAgMzkvcXVvIHB1dAogICAg
ZHlwIBgwL3QgcHV0CiAgICBkdXAgNDEvcGFyhm5yaWdodCBwdXQgZHVwIDQyL2FzdGVyaXNrIHB1
dCBkdXAgNDIvcGx1cyBwdXQgZHVwIDQ0L2NvbW1BIHB1dAogICAgZHVwIDQ1L21pbnVzIHB1dAog
ICAgZHVwIDQ2L3CBcmlvZCBwdXQKCiAvRmFtaWx5TmFtZSAoZ2Vub3R5cGUgUyBCUkspIHJlYXB1
dAogICAgZHVwIDQ1L21pbnVzIDUvbWludXMgcHV0CiAgcHV0CiAgICBkdXAgNDUvcGVAaW9kIHB1
dAoKIC9GYW1pbHlOYW1lIChnZW5vdHlwZSBTIEJSSykgcmVhZG9ubHkgZGVmCiAvV2VpZ2h0IChC
gAElIUZvbnRUeXBlMTExLS46IEhlgAGAAX8aAAAlIVBTLUFkb2JlRm9udC0xLjA6IEJpY2toYW1T
Y3JpcHRNTS1CZWcgMCExLjAwMA0lJUNyZWF0aW9uRGF0ZTogVHVlIEp1bCAyOSAxMTo1Nzo0OCAx
OTk3DSUlVk11c2FnZTogMjAxNjUgMjc4ODgNJSUgQmlja2hhbSBTY3JpcHQgaXMgYSB0cmFkZW1h
cmsgb2YgQWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0ZWQuDTIyIGRpY3QgYmVnaW4NL0ZvbnRJbmZv
IDE0IGRpY3QgZHVwIGJlZ2luDS92ZXJzaW9uICgwMDEuMDAwKSByZWFkb25seSBkZWYNL05vdGlj
ZSAoQ29weXJpZ2h0IChjKSAxOTk3IEFkb2JlIFN5c3RlbXMgSW5jb3IAAQAAAAsAgAADADBPUy8y
QXefAwAAATgAAABWY21hcADAOyoAAAGcAAABRmdhc3D//wADAAAK4AAAAAhnbHlmcvl83wAAAuwA
AAIsaGVhZN2M6yYAAAC8AAAANmhoZWELggLLAAAA9AAAACRobXR4DOkBBQAAAZAAAAAMbG9jYQDA
AX4AAALkAAAACG1heHAEZAB8AAABGAAAACBuYW1lULWR/AAABRgAAAVpcG9zdKwk4zUAAAqEAAAA
WQABAAAAAQAA4+j5w18PPPUACwgAAAAAAL030FsAAAAAvTfTXQAC/hMD/QRdAAAACQABAAAAAAAA
AAEAAD7+B04AQwR2AAIAAwP9AAEAAAAAAAAAAAAAAAAAAAADAAEAAAMCAAAASwAAAAAAAgAQAC8A
QgAABAwAAAAAAAAAAQRNAZAABQAIBZoFMwAAARsFmgUzAAAD0QBmAhIAAAIAAAAAAAAAAAAAAAKH
AAAAAAAAAAAAAAAASEwgIABAAPsA/AXT/lEBMgc+AbJAAAAfAAAAAAAABAAAAgR2AIAEcwCDAAAA
AgABAAAAAAAUAAMAAQAAARoAAAEGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBvcmF0ZWQuICBBbGwgUmln
aHRzIFJlc2VydmVkLkJpY2toYW1VeXBlES0wLnBmYWVkaXQuc2YubmV0LykKJTE6IEhlcnNoZXkl
RW5kQ29tbWVudHMKRm9udETccmVjdG9yeS9HTlUtTGlseVBvbmQtZmV0YS1udW1tZXItMTIga25v
d257L0dOVS1MaWx5UG9uZC1mZXRhLW51bW0oZXItMTMgZmluZGZvbnQAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEICwA
AAAGAAQAAQACAPwBc///AAAA+wFz//8AAP6NAAEABgAAAAAAAgABAAAAAABoAMABFgACIGQgU2Ny
aXB0IGlzIGEgdHJ1cC9VZURpLVBsYWlhZGVtYXJrIG9mIEl1bnEga25vQWRvYmUgU24AAv4TAf0D
lAAlAEoAAAERFB4BNjUyFwUjNQ4BIyIuATURNC4BBzUhERQWMzI2NxE0Jic1Ax8HIyYvASYvBg8F
BisBJz8FYw8hFh8nDgABAAAACwCAAAMAME9TLzJ45HEoAAAA8gAAAFZjbWFw/4j/7AAAAYwAAABq
Z2FzcP//AAQAAAN7AAAACGdseWYJjQeIAAADDgAAADhoZWFk1biUjwAAALwAADZoaGVhC3kCSgAA
AWgAAAAkaG10eAwAAAAAAANGAAAADGxvY2EAAAA4AAAC/gAAABBtYXhwAAgAFgAAAUgAAAAgbmFt
ZWrxoSQAAAH2AAABCHBvc3QBBwIEAAADUgAAACkAAQAAAAEAAZEJzXZfDzz1AAEIAAAAAAe5UiYB
AAAAB7lSJgEAAAAABAAEgAAAAAgAAQABAAABBAABkAAFAAAAzQDNAAAAAADNAM0AAAAAAGYSAAAA
AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAGNlbnQAQP//AEEHIf5FAFcHIQG7AAAAAAAAAAAAAQAA
AAMACAACAAgAAgACAAAAAwAAAAAAAAAAAAAAAQABAAAHIf5FOlcEAAAAAAAEAAABAAAAAAAAAAAA
AAAAAAAAAwAAAAIAAwABAAAAFAADAAoAAABCAAQALgAAAAYABAABAAIAIABB//86AAAAIABB////
////AAAABgCrogAAjQApAAADAgAMAAAAAAAoAAAAAAAAAAIAAAAgAAAAAAAAAQAAAEEAAABBAC1E
eQAAIQIAAAAJAHIAA3MAAQQJAAAAIAA=

Target function:

static FT_Library library;
static int InitResult = FT_Init_FreeType(&library);

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
assert(!InitResult);
FT_Face face;
if (size < 1) return 0;
FT_Int32 load_flags = FT_LOAD_DEFAULT;
FT_Render_Mode render_mode = FT_RENDER_MODE_NORMAL;
if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
#if 1
unsigned first_index = 0;
for (unsigned i = first_index; i < (unsigned int)face->num_glyphs; i++) {
if (FT_Load_Glyph(face, i, load_flags)) continue;
if (FT_Render_Glyph(face->glyph, render_mode)) continue;
// FT_GlyphSlot_Embolden( face->glyph );
FT_Glyph glyph;
if (!FT_Get_Glyph(face->glyph, &glyph)) FT_Done_Glyph(glyph);
FT_Outline *outline = &face->glyph->outline;
FT_Matrix rot30 = { 0xDDB4, -0x8000, 0x8000, 0xDDB4 };
FT_Outline_Transform( outline, &rot30 );
FT_BBox bbox;
FT_Outline_Get_BBox( outline, &bbox );
}
#endif
FT_Done_Face(face);
}
return 0;
}

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 04 Oct 2015 11:08:22 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2

    Back to the top


    Powered by Savane 3.1-cleanup1