bugThe FreeType Project - Bugs: bug #46166, Malformed GX font causes null...

 
 

bug #46166: Malformed GX font causes null dereference on localpoints.

Submitted by:  bungeman <bungeman>
Submitted on:  Fri 09 Oct 2015 03:16:44 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 10 Oct 2015 06:13:52 AM UTC, comment #2:

Fixed in git, thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 09 Oct 2015 03:38:36 PM UTC, comment #1:

Note that ftmulti also crashes on this input, so that may be a simpler way to reproduce.

bungeman <bungeman>
Fri 09 Oct 2015 03:16:44 PM UTC, original submission:

Applying the fuzzer.diff patch (attached) to freetype2 (to add ttc index and some gx variation support to the fuzzer) and running the fuzzer produces the crash data (attached). The issue appears to be that at

TT_Vary_Apply_Glyph_Deltas freetype2/src/truetype/ttgxvar.c:1970:28

localpoints is 0.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35124:  fuzzer.diff added by bungeman (2KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 10 Oct 2015 06:13:52 AM UTCwlItem GroupNone=>Crash
      StatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Fri 09 Oct 2015 03:16:44 PM UTCbungemanAttached File-=>Added fuzzer.diff, #35124
      Attached File-=>Added crash-7cbab19c16498cf1a45355196ee16a9ffb4d5d8f, #35125

    Back to the top


    Powered by Savane 3.1-cleanup1