bugThe FreeType Project - Bugs: bug #46118, src/base/ftglyph.c:407:40: runtime...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46118: src/base/ftglyph.c:407:40: runtime error: left shift of negative value -32768

Submitter:  Kostya Serebryany <kcc>
Submitted:  Sun 04 Oct 2015 06:24:04 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Sun 04 Oct 2015 11:08:22 AM UTC, comment #1: 

Fixed in git, thanks.

 Werner LEMBERG <wl>
Group administrator
Sun 04 Oct 2015 06:24:04 AM UTC, original submission:  

found with libFuzzer+ubsan on fresh git

src/base/ftglyph.c:407:40: runtime error: left shift of negative value -32768

Af8IAQEBBAIAAQEBFkZGUVBJUistLWZvFXQ1OTA0MDYtLQABAQFG+Bv4FCgMHvgdAfgeAG8MA4sM
BDsdBYjcCvwFiNwHix0ATEopHQBMSgYOHFp6DCP3uzsiHAkSDCQcAScRHAEODCUeAOcPAAUBDVMI
AV1xOm91bmRlclBLVUUyQ29weXJpZ2h0KEMpIDE5OTUtOTE5NiBGb3VuZGVyIEdyb3VwIEMvcnBv
cjx0aW9uLiBBbGwgcme+dHMgcmVzj2VydmVkLkVaSC0tUEsxODdBQStBWkEtRUFIQQRQSzc0ODIw
NAAAAPAA8gD4AP8pAgEDAQ4BEAERARIBEwEUAxUqARYBGQEbARwBIAEhAAEiAQEIASi3CicAAAH/
CgMoIQGzQCcAAADQAQifwymPKKcqKAmLAW00KAH/CAEBAAQCAAEBJSFQUy0JZG9iZUZvbnQtMS4w
OiBHTlUtTGlseVBvbmQtZmV0YS1udW1tZXItMTMgMDAwCk0uMTAxJSVUaXQqbGU6IEdOVS1MaWx5
UG9uZC1mZXRhLW51bW1lci0xMgolJUNyZWFpb25hdGU6IFRodSBBcHIgKTE1IDEzOjAzOjM4IDIw
MDQKJTslQ3JlYXRvciByOm9vdAolJURvY3VtZW50U3VwcAH/CAEotwonAAEBAAEAAAEBKCcpIB0q
BCfwuik3YikvKgwHLCgK4KESKAonKiA3bGllZFJlc291cmNlczogZm50JSFGb250VHlwZTItMS4x
IEhncnNoZXktJSFGb250VHlwZTExMS0uOiBIZYABgAFLGiUhUFMtVHJ1ZVR5cGVGb250CiUleXBl
U3Npb246IDMuOjAzQTQzIDIwMT4KJSUhUFOJLVRydWVUeXBlbyUlIVBTLUFkb2JlRm9udDEwOiBD
Li1vdXJpZXItSWFsaWMgMDAxLjAwMwolJUNyZWF0aW9uRGF0ZTogVHVlIFNlcCAxNyAxNjozMDow
MiAxOTkxCiUlVk11c2FnZTogNTs2Njc1IDc1NTk5CiUlIkNvcHlyaWdodCBJbnRlcm5hdGlvbmFs
IEJ1c2luZXNzIE1hY2hpbmVzLENvcnAuIDE5OTEKJSUgSUJNIENvdXJpZXIgaXMgYSBUcmFkZW1h
cmsgb2YgdGhlIElCTSBDb3Jwb3JhdGlvbi4KMCUhRm9udFR5cGUxLTEuMTogSGc0ICFpYyAAACUh
UFMtJSFGb250JSFGb250VCBHTlUtTGlseVBvbgJkAC1mZXQTLXVtbWVyLTEzCiUgR2VuZXJhdGVk
IEZyb20gTWV0YUZvbnQgYml0bWFwIGJ5IG1mdHJhY2UgMS4wLjE5LCBodHRwOi8vd3d3LmNzLnV1
Lm5sLwolIEdlbmVyYXRlZCBieSBQZmFFZGl0IDEuMCAoaHR0cDovL3lwZTEtLjE6IEhlcnNoZXkt
UGxhaW4tRHVwbGV4LUl0YWxpYw0lIUZvbnQlIVBTLUFkb2JlRm9udC0xT1RUTyUhUFMtVHJ1ZVR5
cEZvbnQKJSV5cGVTc2lvbjsgMy46MDNBNDMgMjAxMAolJUNyZWF0b3I6IFJvYm9udE5hbWUgLyBk
ZWYKIGNlbnQgcHUgIGR1cCAzOC9hbXBlcnNhbmQgcHV0CiAgICBkdXAgMzkvcXVvIHB1dAogICAg
ZHlwIBgwL3QgcHV0CiAgICBkdXAgNDEvcGFyhm5yaWdodCBwdXQgZHVwIDQyL2FzdGVyaXNrIHB1
dCBkdXAgNDIvcGx1cyBwdXQgZHVwIDQ0L2NvbW1BIHB1dAogICAgZHVwIDQ1L21pbnVzIHB1dAog
ICAgZHVwIDQ2L3CBcmlvZCBwdXQKCiAvRmFtaWx5TmFtZSAoZ2Vub3R5cGUgUyBCUkspIHJlYXB1
dAogICAgZHVwIDQ1L21pbnVzIDUvbWludXMgcHV0CiAgcHV0CiAgICBkdXAgNDUvcGVAaW9kIHB1
dAoKIC9GYW1pbHlOYW1lIChnZW5vdHlwZSBTIEJSSykgcmVhZG9ubHkgZGVmCiAvV2VpZ2h0IChC
gAElIUZvbnRUeXBlMTExLS46IEhlgAGAAX8aAAAlIVBTLUFkb2JlRm9udC0xLjA6IEJpY2toYW1T
Y3JpcHRNTS1CZWcgMCExLjAwMA0lJUNyZWF0aW9uRGF0ZTogVHVlIEp1bCAyOSAxMTo1Nzo0OCAx
OTk3DSUlVk11c2FnZTogMjAxNjUgMjc4ODgNJSUgQmlja2hhbSBTY3JpcHQgaXMgYSB0cmFkZW1h
cmsgb2YgQWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0ZWQuDTIyIGRpY3QgYmVnaW4NL0ZvbnRJbmZv
IDE0IGRpY3QgZHVwIGJlZ2luDS92ZXJzaW9uICgwMDEuMDAwKSByZWFkb25seSBkZWYNL05vdGlj
ZSAoQ29weXJpZ2h0IChjKSAxOTk3IEFkb2JlIFN5c3RlbXMgSW5jb3IAAQAAAAsAgAADADBPUy8y
QXefAwAAATgAAABWY21hcADAOyoAAAGcAAABRmdhc3D//wADAAAK4AAAAAhnbHlmcvl83wAAAuwA
AAIsaGVhZN2M6yYAAAC8AAAANmhoZWELggLLAAAA9AAAACRobXR4DOkBBQAAAZAAAAAMbG9jYQDA
AX4AAALkAAAACG1heHAEZAB8AAABGAAAACBuYW1lULWR/AAABRgAAAVpcG9zdKwk4zUAAAqEAAAA
WQABAAAAAQAA4+j5w18PPPUACwgAAAAAAL030FsAAAAAvTfTXQAC/hMD/QRdAAAACQABAAAAAAAA
AAEAAD7+B04AQwR2AAIAAwP9AAEAAAAAAAAAAAAAAAAAAAADAAEAAAMCAAAASwAAAAAAAgAQAC8A
QgAABAwAAAAAAAAAAQRNAZAABQAIBZoFMwAAARsFmgUzAAAD0QBmAhIAAAIAAAAAAAAAAAAAAAKH
AAAAAAAAAAAAAAAASEwgIABAAPsA/AXT/lEBMgc+AbJAAAAfAAAAAAAABAAAAgR2AIAEcwCDAAAA
AgABAAAAAAAUAAMAAQAAARoAAAEGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBvcmF0ZWQuICBBbGwgUmln
aHRzIFJlc2VydmVkLkJpY2toYW1VeXBlES0wLnBmYWVkaXQuc2YubmV0LykKJTE6IEhlcnNoZXkl
RW5kQ29tbWVudHMKRm9udETccmVjdG9yeS9HTlUtTGlseVBvbmQtZmV0YS1udW1tZXItMTIga25v
d257L0dOVS1MaWx5UG9uZC1mZXRhLW51bW0oZXItMTMgZmluZGZvbnQAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEICwA
AAAGAAQAAQACAPwBc///AAAA+wFz//8AAP6NAAEABgAAAAAAAgABAAAAAABoAMABFgACIGQgU2Ny
aXB0IGlzIGEgdHJ1cC9VZURpLVBsYWlhZGVtYXJrIG9mIEl1bnEga25vQWRvYmUgU24AAv4TAf0D
lAAlAEoAAAERFB4BNjUyFwUjNQ4BIyIuATURNC4BBzUhERQWMzI2NxE0Jic1Ax8HIyYvASYvBg8F
BisBJz8FYw8hFh8nDgABAAAACwCAAAMAME9TLzJ45HEoAAAA8gAAAFZjbWFw/4j/7AAAAYwAAABq
Z2FzcP//AAQAAAN7AAAACGdseWYJjQeIAAADDgAAADhoZWFk1biUjwAAALwAADZoaGVhC3kCSgAA
AWgAAAAkaG10eAwAAAAAAANGAAAADGxvY2EAAAA4AAAC/gAAABBtYXhwAAgAFgAAAUgAAAAgbmFt
ZWrxoSQAAAH2AAABCHBvc3QBBwIEAAADUgAAACkAAQAAAAEAAZEJzXZfDzz1AAEIAAAAAAe5UiYB
AAAAB7lSJgEAAAAABAAEgAAAAAgAAQABAAABBAABkAAFAAAAzQDNAAAAAADNAM0AAAAAAGYSAAAA
AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAGNlbnQAQP//AEEHIf5FAFcHIQG7AAAAAAAAAAAAAQAA
AAMACAACAAgAAgACAAAAAwAAAAAAAAAAAAAAAQABAAAHIf5FOlcEAAAAAAAEAAABAAAAAAAAAAAA
AAAAAAAAAwAAAAIAAwABAAAAFAADAAoAAABCAAQALgAAAAYABAABAAIAIABB//86AAAAIABB////
//AAAABgCrogAAjQApAAADAgAMAAAAAAAoAAAAAAAAAAIAAAAgAAAAAAAAAQAAAEEAAABBAC1E
eQAAIQIAAAAJAHIAA3MAAQQJAAAAIAA=

Target function:

static FT_Library  library;
static int InitResult = FT_Init_FreeType(&library);

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  assert(!InitResult);
  FT_Face face;
  if (size < 1) return 0;
  FT_Int32 load_flags = FT_LOAD_DEFAULT;
  FT_Render_Mode  render_mode = FT_RENDER_MODE_NORMAL;
  if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
#if 1
    unsigned first_index = 0;
    for (unsigned i = first_index; i < (unsigned int)face->num_glyphs; i++) {
      if (FT_Load_Glyph(face, i, load_flags)) continue;
      if (FT_Render_Glyph(face->glyph, render_mode)) continue;
      // FT_GlyphSlot_Embolden( face->glyph );
      FT_Glyph      glyph;
      if (!FT_Get_Glyph(face->glyph, &glyph)) FT_Done_Glyph(glyph);
      FT_Outline *outline = &face->glyph->outline;
      FT_Matrix     rot30 = { 0xDDB4, -0x8000, 0x8000, 0xDDB4 };
      FT_Outline_Transform( outline, &rot30 );
      FT_BBox       bbox;
      FT_Outline_Get_BBox( outline, &bbox );
    }
#endif
    FT_Done_Face(face);
  }
  return 0;
}

 Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-04 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-8e77.
    Corresponding source code