bugThe FreeType Project - Bugs: bug #48979, signed integer overflow in...

 
 

bug #48979: signed integer overflow in [@Ins_ADD]

Submitted by:  Tyson Smith <twsmith>
Submitted on:  Fri 02 Sep 2016 06:13:35 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.8.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 01 Jun 2017 04:28:01 PM UTC, comment #4:

This is now fixed in git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 06 Sep 2016 03:17:12 PM UTC, comment #3:

Yes, this could be done, together with the markup mentioned in https://savannah.nongnu.org/bugs/?46149#comment8

Another, probably better solution is to use code similar to gnulib's `intprops.h' header file (search for `Range overflow checks'), especially since recent gcc versions (and probably clang also) support overflow operator handling natively.

http://git.savannah.gnu.org/cgit/gnulib.git/tree/lib/intprops.h

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 06 Sep 2016 02:51:10 PM UTC, comment #2:

We can substitute the overflow with unsigned wrap-around, which would make it legal. Other than that there is no harm. Basically,

Alexei Podtelezhnikov <podtelez>
Project Member
Fri 02 Sep 2016 08:07:53 PM UTC, comment #1:

Thanks for the report; hopefully, I'll find some time to fix this later in this year.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 02 Sep 2016 06:13:35 PM UTC, original submission:

Moving bugzilla report here. https://bugzilla.mozilla.org/show_bug.cgi?id=1295376

Found while fuzzing freetype2 commit 248f5629d8889aa5b77ea5bfce0935140293d50d (>2.6.5)

This was found while fuzzing with an Undefined Behavior Sanitizer build.

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #38409:  test_case.ttf added by twsmith (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by podtelez (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by twsmith (Submitted the item)
  • -unavailable- added by twsmith
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 01 Jun 2017 04:28:01 PM UTCwlStatusPostponed=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.8.1
    Fri 02 Sep 2016 08:07:53 PM UTCwlStatusNone=>Postponed
      Assigned toNone=>wl
    Fri 02 Sep 2016 06:13:35 PM UTCtwsmithAttached File-=>Added test_case.ttf, #38409
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1