bugThe FreeType Project - Bugs: bug #54986, FT_Glyph_To_Bitmap returns an...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54986: FT_Glyph_To_Bitmap returns an error when it shouldn't - #2

Submitter:  Sylvain <slvn>
Submitted:  Thu 08 Nov 2018 01:18:54 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  None Open/Closed:  Closed
Planned Release:  2.10.0

Jump to the original submission

Fri 16 Nov 2018 09:23:59 AM UTC, comment #13: 

Thanks for the reply;  yes, some of these fonts are broken but it doesn't really matter since libFuzzer + co only use them as base for mutations.

Should you ever come across interesting/specific (small) sample fonts (spec. handcrafted + SIL licensed) other than TrueType, feel free to share them with us please, always looking for ways to challenge FreeType :)

Armin <cherusker>
Group Member
Fri 16 Nov 2018 07:20:46 AM UTC, comment #12: 

Just to let you know. I took the fonts from the previous link,
and added them to my test app, and it didn't show more issue!

( I believe some are broken refusing to get opened)

./CMap2.ttf
./Composite.ttf
./DistortableMM.pfa
./DistortableMM_pfa_afm.tar
./DistortableMM_pfa_pfm.tar
./DistortableMM.pfb
./DistortableMM_pfb_afm.tar
./DistortableMM_pfb_pfm.tar
./Distortable.ttf
./HangingS-16.bdf
./HangingS-16.fnt
./HangingS-16lL.pcf
./HangingS-16lM.pcf
./HangingS-16mL.pcf
./HangingS-16mM.pcf
./HangingS.bin
./HangingS.cid
./HangingS_cid.otf
./HangingS.dfont
./HangingS.fon
./HangingS.otf
./HangingS-PE.fon
./HangingS.pfa
./HangingS_pfa_afm.tar
./HangingS_pfa_pfm.tar
./HangingS.pfb
./HangingS_pfb_afm.tar
./HangingS_pfb_pfm.tar
./HangingS.ps
./HangingS.t42
./HangingS.ttf
./HangingS.woff
./UVSTest.ttf


Sylvain <slvn>
Tue 13 Nov 2018 02:25:23 PM UTC, comment #11: 

I think the stroker is the only module in freetype that creates new outlines. These two bugs found errors in this process. A failure in FT_Outline_Decompose is probably not something oss-fuss should care about.

I did notice non-zero error counts in our demo-tools specifically  in the stroker before. Sylvian made it so easy to debug with his small demo programs that they could not be ignored.

Alexei Podtelezhnikov <podtelez>
Group Member
Tue 13 Nov 2018 11:46:45 AM UTC, comment #10: 

So it seems that `ITCAvantGardeStd-Demi.ttf' should actually be called `ITCAvantGardeStd-Demi.otf'.

[Note that both TTF and OTF use the `SFNT' container format.  Usually, you can recognize the font format looking at the first four bytes: they are `OTTO' for OTFs.]

Werner LEMBERG <wl>
Group administrator
Tue 13 Nov 2018 10:22:29 AM UTC, comment #9: 

Thanks, I'll grab some font from the link.

I got the pcf from my linux distribution, in X11. I think they are non-scalable font.
The .fon comes from users .. I think they are also non-scalable.

you can find the few fonts (and the test program) here:
https://bugzilla.libsdl.org/show_bug.cgi?id=4374


Ok I found out `ITCAvantGardeStd-Demi.ttf' requires the CFF/OpenType font driver !

Sylvain <slvn>
Tue 13 Nov 2018 09:52:22 AM UTC, comment #8: 

We do have a few nifty specimen.  Feel free to browse https://github.com/freetype/freetype2-testing/tree/master/fuzzing/corpora -- findings of OSS-Fuzz are marked with the respective issues they found;  most of them would not produce meaningful graphical output however ;)

Also we're always on the lookout for new input fonts for the fuzzers; in particular PCF + FON.  What fonts are these / how are they licensed / have you created them yourself?

About the issue with minimal FT2 you mentioned; I don't know about that, Alexei or Werner can hopefully answer that :)

Armin <cherusker>
Group Member
Tue 13 Nov 2018 09:48:40 AM UTC, comment #7: 

Are you sure that `ITCAvantGardeStd-Demi.ttf' is a TrueType font?  This is one of the core Adobe fonts, so I would expect it to be a Type 1 font...

You might send it to me privately for further inspection.

Werner LEMBERG <wl>
Group administrator
Tue 13 Nov 2018 09:32:09 AM UTC, comment #6: 

Thank for the links I didn't know those tools, it looks quite complicated for my purpose though.
Btw, I'm not intending to fully test the Stroker nor FreeType, but I report issue that I found when stress-testing my lib that use FT2.
I am just loading fonts, settings some "size/style/parameters" and trying to render strings.

If you have specific/pathologic/complex font that would disturb user or FT2, I can add them in the meantime and, who knows, reports other issues.
I have a lots of ttf, a few pcf.gz and .fon.

BTW, this current font (ITCAvantGardeStd-Demi.ttf) doesn't seem to load with a minimal FreeType2 build (only modules truetype,psnames,sfnt, +raster/smooth and no FT_CONFIG_OPTION_USE_ZLIB). Is that normal or a specific format ? (all my others TTF loads correctly).

Sylvain <slvn>
Mon 12 Nov 2018 10:25:49 PM UTC, comment #5: 

Nope, the stroker is currently not under test (on a todo list however) but these two bugs are definitely a good motivation to add support for that soon :)

Armin <cherusker>
Group Member
Fri 09 Nov 2018 02:46:57 PM UTC, comment #4: 

Are you familiar with  off-fuzz and particularly freetype2-testing? AFAIK they did not test the stroker, where you found both bug #54976 and bug #54986.

I will Cc Armin.


Alexei Podtelezhnikov <podtelez>
Group Member
Fri 09 Nov 2018 02:13:36 PM UTC, comment #3: 

Thanks again, it fixes the issue.

I am modifying a text rendering rendering library (SDL2_ttf) based on FreeType, and I am now running a random infinite test to spot bugs.
Millions of strings rendered without breaking it, so I think I am almost done.

If you have specific pathologic font files or strings, I can incorporate them.

Sylvain <slvn>
Fri 09 Nov 2018 02:07:18 AM UTC, comment #2: 

Already committed.

Alexei Podtelezhnikov <podtelez>
Group Member
Thu 08 Nov 2018 05:26:08 PM UTC, comment #1: 

You must be doing something scrupulous to find these bugs. Please continue testing.

This is a fix:

diff --git a/src/base/ftstroke.c b/src/base/ftstroke.c
index 8a9e7db..86cb6d0 100644
--- a/src/base/ftstroke.c
+++ b/src/base/ftstroke.c
@@ -432,8 +432,8 @@
     }
     else
     {
-      /* don't add zero-length lineto */
-      if ( border->num_points > 0                                          &&
+      /* don't add zero-length lineto, but always add moveto */
+      if ( border->num_points > border->start                              &&
            FT_IS_SMALL( border->points[border->num_points - 1].x - to->x ) &&
            FT_IS_SMALL( border->points[border->num_points - 1].y - to->y ) )
         return error;


Alexei Podtelezhnikov <podtelez>
Group Member
Thu 08 Nov 2018 01:18:54 PM UTC, original submission:  

Maybe similar to bug #54976
but the solution provided there isn't enough.
I am splitting this into a new bug.


When using the font ITCAvantGardeStd-Demi.ttf
and doing some manipulation, it appears the character "Q" failed to render.

The glyph is loaded with hinting "NONE".

Size is set to:
FT_Set_Char_Size(face, 0, 4 * 64, 0, 0);

Stroker to:
FT_Stroker_Set(stroker, 1 * 64, FT_STROKER_LINECAP_ROUND, FT_STROKER_LINEJOIN_ROUND, 0);

FT_Glyph_Stroke() succeed, but FT_Glyph_To_Bitmap() failed.

Any higher/lower value would succeed, which makes this scenario be a corner case.

Here a test-case, reproduced on repository head. with patch from #54976 added

Sylvain <slvn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #45386:  bug_freetype_2.c added by slvn (3KiB - text/x-csrc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by cherusker (Posted a comment)
  • -email is unavailable- added by podtelez
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by slvn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-09 podtelez Carbon-Copy- Added -email is unavailable-
    2018-11-09 podtelez StatusReady For Test Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.0
    2018-11-08 podtelez StatusNone Ready For Test
    2018-11-08 slvn Attached File- Added ITCAvantGardeStd-Demi.ttf, #45385
        Attached File- Added bug_freetype_2.c, #45386

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code