bugThe FreeType Project - Bugs: bug #46159, 12K input consumes 2.5Gb RAM in...

 
 

bug #46159: 12K input consumes 2.5Gb RAM in 32-bit mode

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Thu 08 Oct 2015 05:49:09 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 09 Oct 2015 07:44:26 AM UTC, comment #5:

In this case, I can only slightly improve result (now in git): In gzipped streams, the real file size is stored at the very end; for your test file, those bytes are invalid, indicating a huge size. Together with the invalid (i.e., far too large) number of TOC entries in the PCF, this leads to the big memory allocation.

It's simply not possible to deduce the uncompressed file size from a gzipped file's size.

Note that I could theoretically improve the memory allocation in FreeType by allocating the memory in smaller chunks. However, I think this is overkill (making FreeType slower) just to handle broken fonts better. Additionally, on my GNU/Linux box, there is zero penalty because memory allocation is done lazily – valgrind doesn't report any big allocation at all for the test file.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Oct 2015 11:31:49 PM UTC, comment #4:

one more

(file #35111)

Kostya Serebryany <kcc>
Project Member
Thu 08 Oct 2015 09:18:44 PM UTC, comment #3:

Again a different font format (PCF this time). Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Oct 2015 07:49:49 PM UTC, comment #2:

attached 4 more similar reproducers, still unfixed.

Kostya Serebryany <kcc>
Project Member
Thu 08 Oct 2015 07:33:42 PM UTC, comment #1:

Yep, similar, but different font format. Thanks for the report, now fixed in git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Oct 2015 05:49:09 PM UTC, original submission:

found with libFuzzer in 32-bit mode
Similar to #46150, but I see it after the fix for it.
Repro attached.

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35111:  crash-a671c4146385ba3bba0ddb23dca46e7d9ff4ec9b added by kcc (2KiB - application/octet-stream)
file #35107:  crash-19491c00d5274d72c7339e1c77af037f7dabefa2 added by kcc (1KiB - application/octet-stream - few more reproducers, still unfixed.)
file #35108:  crash-3124971d9e4464992b09c8766f07671f0ecb3c3c added by kcc (1KiB - application/octet-stream - few more reproducers, still unfixed.)
file #35109:  crash-568c73cba36d9ad558359d92870b25026f0d67b2 added by kcc (790B - application/octet-stream - few more reproducers, still unfixed.)
file #35110:  crash-8625327c9e9f2dcc44486d0beed1d7310f88abe0 added by kcc (491B - application/octet-stream - few more reproducers, still unfixed.)
file #35106:  crash-c006ef923e5615589094e893c062caa18a2bc84e added by kcc (11KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 15 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 09 Oct 2015 07:44:26 AM UTCwlStatusNone=>Fixed
    Thu 08 Oct 2015 11:32:00 PM UTCkccStatusFixed=>None
    Thu 08 Oct 2015 11:31:49 PM UTCkccAttached File-=>Added crash-a671c4146385ba3bba0ddb23dca46e7d9ff4ec9b, #35111
    Thu 08 Oct 2015 09:18:44 PM UTCwlStatusNone=>Fixed
    Thu 08 Oct 2015 07:49:25 PM UTCkccStatusFixed=>None
    Thu 08 Oct 2015 07:49:12 PM UTCkccAttached File-=>Added crash-19491c00d5274d72c7339e1c77af037f7dabefa2, #35107
      Attached File-=>Added crash-3124971d9e4464992b09c8766f07671f0ecb3c3c, #35108
      Attached File-=>Added crash-568c73cba36d9ad558359d92870b25026f0d67b2, #35109
      Attached File-=>Added crash-8625327c9e9f2dcc44486d0beed1d7310f88abe0, #35110
    Thu 08 Oct 2015 07:33:42 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Thu 08 Oct 2015 05:49:23 PM UTCkccSummary12K input sonsumes 2.5Gb RAM in 32-bit mode=>12K input consumes 2.5Gb RAM in 32-bit mode
    Thu 08 Oct 2015 05:49:09 PM UTCkccAttached File-=>Added crash-c006ef923e5615589094e893c062caa18a2bc84e, #35106

    Back to the top


    Powered by Savane 3.1-cleanup1