bugThe FreeType Project - Bugs: bug #46408, Hang when decoding small malformed...

 
 

bug #46408: Hang when decoding small malformed PS font.

Submitted by:  bungeman <bungeman>
Submitted on:  Mon 09 Nov 2015 04:56:00 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 09 Nov 2015 08:38:50 PM UTC, comment #4:

I could download the files. The problem is now fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 09 Nov 2015 07:16:44 PM UTC, comment #3:

Perhaps it's the characters in the file names, I've edited the file names to be less weird. The '12' is the one with the big number, '19' is related and setting CIDCount to '-8' which leads face->num_glyphs to be '-8', which is surprising.

(file #35426, file #35427)

bungeman <bungeman>
Mon 09 Nov 2015 06:12:42 PM UTC, comment #2:

Please re-upload the font in compressed form – for some reason, it is not possible to download it from this page.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 09 Nov 2015 06:06:32 PM UTC, comment #1:

Note that this isn't a true hang, it does eventually finish after looping over 102222228 glyphs. Also, I'm not even sure what to do about this, the specification doesn't appear to have anything against such large numbers here, and it is documented that num_glyphs is 'For CID-keyed fonts, this value gives the highest CID used in the font.' Though I suppose it could be argued that there are no such CID mappings, so the value is bogus.

bungeman <bungeman>
Mon 09 Nov 2015 04:56:00 PM UTC, original submission:

This one was found with AFL driving ftfuzzer/runinput.cc at FreeType 837285e40772aa10338bcb1fa5118ec93d575a8d, reproduction attached.

When running runinput with the following input, it doesn't finish (at least in any reasonable amount of time). It appears that this font states that it contains a large number of glyphs (102222228), which is far more than most are prepared to deal with.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35426:  id_000012_src_024176_op_havoc_rep_2 added by bungeman (302B - application/octet-stream)
file #35427:  id_000019_src_024175_op_havoc_rep_8 added by bungeman (633B - application/octet-stream)
file #35423:  id:000012,src:024176,op:havoc,rep:2 added by bungeman (302B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 09 Nov 2015 08:38:50 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Mon 09 Nov 2015 07:16:44 PM UTCbungemanAttached File-=>Added id_000012_src_024176_op_havoc_rep_2, #35426
      Attached File-=>Added id_000019_src_024175_op_havoc_rep_8, #35427
    Mon 09 Nov 2015 04:56:00 PM UTCbungemanAttached File-=>Added id:000012,src:024176,op:havoc,rep:2, #35423

    Back to the top


    Powered by Savane 3.1-cleanup1