bugThe FreeType Project - Bugs: bug #46150, 1K input consumes 2Gb of RAM in...

 
 

bug #46150: 1K input consumes 2Gb of RAM in 32-bit mode

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Thu 08 Oct 2015 01:47:19 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 13 Oct 2015 04:11:45 AM UTC, comment #6:

I really meant Type 1 – I was obviously confused, mixing up the font format of this bug...

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 12 Oct 2015 08:49:31 PM UTC, comment #5:

Werner, you meant that 'CFF had a issue similar to this one', didn't you?
(Note that this bug is about Type 1.)
If so, could you tell me when the issue (similar to this) in CFF was fixed?

Thanks

Jungshik Shin <jungshik>
Thu 08 Oct 2015 09:30:56 PM UTC, comment #4:

Type 1 fonts had a similar issue, yes. Previous fuzzying runs on FreeType didn't hit those issues.

Note that FreeType's previous behaviour was not invalid, it just unnecessarily consumed a lot of memory until the broken font was rejected.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Oct 2015 08:08:55 PM UTC, comment #3:

Does this issue affect just type 1 font? Or, does it affect CFF as well?

Anonymous
Thu 08 Oct 2015 09:34:08 AM UTC, comment #2:

It's not an overflow issue but rather the same problem as issue #46029. Fixed now in git, thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Oct 2015 03:01:56 AM UTC, comment #1:

smells like unsigned long overflow somewhere, please confirm.

Kostya Serebryany <kcc>
Project Member
Thu 08 Oct 2015 01:47:19 AM UTC, original submission:

Found with libFuzzer in 32-bit mode.
Feed the attached input into
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/diff/src/tools/ftfuzzer/ftfuzzer.cc

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35097:  crash-a01b4caabc4b22ed6be5d5513268d23b4d5d3dc3 added by kcc (1018B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jungshik (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 08 Oct 2015 09:34:08 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Thu 08 Oct 2015 01:47:19 AM UTCkccAttached File-=>Added crash-a01b4caabc4b22ed6be5d5513268d23b4d5d3dc3, #35097

    Back to the top


    Powered by Savane 3.1-cleanup1