bugThe FreeType Project - Bugs: bug #46150, 1K input consumes 2Gb of RAM in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #46150: 1K input consumes 2Gb of RAM in 32-bit mode

Submitter:  Kostya Serebryany <kcc>
Submitted:  Thu 08 Oct 2015 01:47:19 AM UTC
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Jump to the original submission

Tue 13 Oct 2015 04:11:45 AM UTC, comment #6: 

I really meant Type 1 – I was obviously confused, mixing up the font format of this bug...

Werner LEMBERG <wl>
Group administrator
Mon 12 Oct 2015 08:49:31 PM UTC, comment #5: 

Werner, you meant that 'CFF had a issue similar to this one', didn't you?
(Note that this bug is about Type 1.)
If so, could you tell me when the issue (similar to this)  in CFF was fixed?


Jungshik Shin <jungshik>
Thu 08 Oct 2015 09:30:56 PM UTC, comment #4: 

Type 1 fonts had a similar issue, yes.  Previous fuzzying runs on FreeType didn't hit those issues.

Note that FreeType's previous behaviour was not invalid, it just unnecessarily consumed a lot of memory until the broken font was rejected.

Werner LEMBERG <wl>
Group administrator
Thu 08 Oct 2015 08:08:55 PM UTC, comment #3: 

Does this issue affect just type 1 font? Or, does it affect CFF as well?

Thu 08 Oct 2015 09:34:08 AM UTC, comment #2: 

It's not an overflow issue but rather the same problem as issue #46029.  Fixed now in git, thanks for the report.

Werner LEMBERG <wl>
Group administrator
Thu 08 Oct 2015 03:01:56 AM UTC, comment #1: 

smells like unsigned long overflow somewhere, please confirm.

Kostya Serebryany <kcc>
Group Member
Thu 08 Oct 2015 01:47:19 AM UTC, original submission:  

Found with libFuzzer in 32-bit mode.
Feed the attached input into

Kostya Serebryany <kcc>
Group Member


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35097:  crash-a01b4caabc4b22ed6be5d5513268d23b4d5d3dc3 added by kcc (1018B - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by jungshik (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-08 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-08 kcc Attached File- Added crash-a01b4caabc4b22ed6be5d5513268d23b4d5d3dc3, #35097

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code