bugThe FreeType Project - Bugs: bug #52082, ubsan complaining about negating...

 
 

bug #52082: ubsan complaining about negating LONG_MIN in FT_ABS.

Submitted by:  bungeman <bungeman>
Submitted on:  Thu 21 Sep 2017 06:58:35 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.8.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 28 Sep 2017 05:11:12 PM UTC, comment #7:

Ouch, and thanks for the fix! Now in git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 28 Sep 2017 04:30:34 PM UTC, comment #6:

Alas, as commented at https://bugs.chromium.org/p/chromium/issues/detail?id=769635#c5 it appears that this test should be

where everything is and-ed together since

solve abs(x - y) < z for x

=>

z > 0 && y - z < x < y + z

=>

z > 0 && x < y + z && x > y - z

applying this change seems to fix issues with displaying the attached subsetted font file in ftview.

(file #41947)

bungeman <bungeman>
Fri 22 Sep 2017 10:46:45 PM UTC, comment #5:

Thanks a lot! Committed to git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 22 Sep 2017 05:58:23 PM UTC, comment #4:

Changing the test to something like

seems to restore the old behavior.

bungeman <bungeman>
Fri 22 Sep 2017 04:38:48 PM UTC, comment #3:

After staring at this for a minute, perhaps the part that is missing from the test is a check for exc->GS.single_width_cutin being positive. (Previously if exc->GS.single_width_cutin was negative it was always less than any absolute value.)

bungeman <bungeman>
Fri 22 Sep 2017 04:24:09 PM UTC, comment #2:

This seemed to have changed a lot of behavior, which I don't think was intended. The roll at

https://chromium-review.googlesource.com/c/chromium/src/+/678395

produces the following list of changes

https://storage.googleapis.com/chromium-layout-test-archives/linux_chromium_rel_ng/550769/layout-test-results/results.html .

(It did fix the ubsan issue though.)

bungeman <bungeman>
Thu 21 Sep 2017 07:23:18 PM UTC, comment #1:

Fixed in git. Please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 21 Sep 2017 06:58:35 PM UTC, original submission:

Original report at https://bugs.chromium.org/p/chromium/issues/detail?id=753690 .

The general issue is in include/freetype/internal/ftobjs.h which has

which will cause ubsan to complain with signed minimum values.

The more specific issue from the original report is

I'll try to put together a reproducing case which is simpler than building Chromium's pdf_font_fuzzer target.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41947:  algerian.ttf added by bungeman (8KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 28 Sep 2017 04:30:34 PM UTCbungemanAttached File-=>Added algerian.ttf, #41947
    Thu 21 Sep 2017 07:23:18 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.8.2

    Back to the top


    Powered by Savane 3.1-cleanup1