(
Jump to the original submission)
Tue 13 Oct 2015 04:11:45 AM UTC, comment #6:
I really meant Type 1 – I was obviously confused, mixing up the font format of this bug...
|
Mon 12 Oct 2015 08:49:31 PM UTC, comment #5:
Werner, you meant that 'CFF had a issue similar to this one', didn't you?
(Note that this bug is about Type 1.)
If so, could you tell me when the issue (similar to this) in CFF was fixed?
Thanks
|
Thu 08 Oct 2015 09:30:56 PM UTC, comment #4:
Type 1 fonts had a similar issue, yes. Previous fuzzying runs on FreeType didn't hit those issues.
Note that FreeType's previous behaviour was not invalid, it just unnecessarily consumed a lot of memory until the broken font was rejected.
|
Thu 08 Oct 2015 08:08:55 PM UTC, comment #3:
Does this issue affect just type 1 font? Or, does it affect CFF as well?
|
Thu 08 Oct 2015 09:34:08 AM UTC, comment #2:
It's not an overflow issue but rather the same problem as issue #46029. Fixed now in git, thanks for the report.
|
Thu 08 Oct 2015 03:01:56 AM UTC, comment #1:
smells like unsigned long overflow somewhere, please confirm.
|
Thu 08 Oct 2015 01:47:19 AM UTC, original submission:
Found with libFuzzer in 32-bit mode.
Feed the attached input into
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/diff/src/tools/ftfuzzer/ftfuzzer.cc
|
(Note: upload size limit is set to 16384 kB, after insertion of the required
escape characters.)
Attach File(s):
Comment:
Depends on the following items: None found
Items that depend on this one: None found
Follow 5 latest changes.