bugThe FreeType Project - Bugs: bug #46167, Infinite loop when using...

 
 

bug #46167: Infinite loop when using tt_cmap8_char_next .

Submitted by:  bungeman <bungeman>
Submitted on:  Fri 09 Oct 2015 07:44:08 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 14 Jan 2016 07:10:44 PM UTC, comment #4:

Since there has been some interest, this was found with libfuzzer and was fixed with 8de39a7919ad1bbd433dd62810c91272b7095455. When this hang occurs (in the parent of the above commit, with the attached test case), the stack looks something like

in other words, this is triggered when loading a glyph and the autohinter goes to determine how to hint it.

bungeman <bungeman>
Tue 13 Oct 2015 06:18:15 AM UTC, comment #3:

Since it's fixed now, I think it is better to make the bug report public so that other people can apply the patch easily.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 12 Oct 2015 09:01:56 PM UTC, comment #2:

By the way, I marked this as private because this is a 'consume a cpu' (denial of service) issue as opposed to just a crash. There isn't anything private about any of the data or the report itself, so feel free to mark as public as you see fit.

bungeman <bungeman>
Sat 10 Oct 2015 11:34:59 AM UTC, comment #1:

Fixed in git. Thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 09 Oct 2015 07:44:08 PM UTC, original submission:

Opening the attached invalid data in ftview causes an infinite loop in FT_Get_Next_Char.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 13 Oct 2015 06:18:15 AM UTCwlPrivacyPrivate=>Public
    Sat 10 Oct 2015 11:34:59 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Fri 09 Oct 2015 07:44:08 PM UTCbungemanAttached File-=>Added crash-7d78beec4b337680efafff074b24610be23ae3ac, #35127

    Back to the top


    Powered by Savane 3.1-cleanup1