(
Jump to the original submission)
Thu 28 Sep 2017 05:11:12 PM UTC, comment #7:
Ouch, and thanks for the fix! Now in git.
|
Thu 28 Sep 2017 04:30:34 PM UTC, comment #6:
Alas, as commented at https://bugs.chromium.org/p/chromium/issues/detail?id=769635#c5 it appears that this test should be
where everything is and-ed together since
solve abs(x - y) < z for x
=>
z > 0 && y - z < x < y + z
=>
z > 0 && x < y + z && x > y - z
applying this change seems to fix issues with displaying the attached subsetted font file in ftview.
(file #41947)
|
Fri 22 Sep 2017 10:46:45 PM UTC, comment #5:
Thanks a lot! Committed to git.
|
Fri 22 Sep 2017 05:58:23 PM UTC, comment #4:
Changing the test to something like
seems to restore the old behavior.
|
Fri 22 Sep 2017 04:38:48 PM UTC, comment #3:
After staring at this for a minute, perhaps the part that is missing from the test is a check for exc->GS.single_width_cutin being positive. (Previously if exc->GS.single_width_cutin was negative it was always less than any absolute value.)
|
Fri 22 Sep 2017 04:24:09 PM UTC, comment #2:
This seemed to have changed a lot of behavior, which I don't think was intended. The roll at
https://chromium-review.googlesource.com/c/chromium/src/+/678395
produces the following list of changes
https://storage.googleapis.com/chromium-layout-test-archives/linux_chromium_rel_ng/550769/layout-test-results/results.html .
(It did fix the ubsan issue though.)
|
Thu 21 Sep 2017 07:23:18 PM UTC, comment #1:
Fixed in git. Please test.
|
Thu 21 Sep 2017 06:58:35 PM UTC, original submission:
Original report at https://bugs.chromium.org/p/chromium/issues/detail?id=753690 .
The general issue is in include/freetype/internal/ftobjs.h which has
which will cause ubsan to complain with signed minimum values.
The more specific issue from the original report is
I'll try to put together a reproducing case which is simpler than building Chromium's pdf_font_fuzzer target.
|
(Note: upload size limit is set to 16384 kB, after insertion of the required
escape characters.)
Attach File(s):
Comment:
Depends on the following items: None found
Items that depend on this one: None found
Follow 5 latest changes.