bugThe FreeType Project - Bugs: bug #46159, 12K input consumes 2.5Gb RAM in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46159: 12K input consumes 2.5Gb RAM in 32-bit mode

Submitter:  Kostya Serebryany <kcc>
Submitted:  Thu 08 Oct 2015 05:49:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Fri 09 Oct 2015 07:44:26 AM UTC, comment #5: 

In this case, I can only slightly improve result (now in git):  In gzipped streams, the real file size is stored at the very end; for your test file, those bytes are invalid, indicating a huge size.  Together with the invalid (i.e., far too large) number of TOC entries in the PCF, this leads to the big memory allocation.

It's simply not possible to deduce the uncompressed file size from a gzipped file's size.

Note that I could theoretically improve the memory allocation in FreeType by allocating the memory in smaller chunks.  However, I think this is overkill (making FreeType slower) just to handle broken fonts better.  Additionally, on my GNU/Linux box, there is zero penalty because memory allocation is done lazily – valgrind doesn't report any big allocation at all for the test file.

Werner LEMBERG <wl>
Group administrator
Thu 08 Oct 2015 11:31:49 PM UTC, comment #4: 

one more

(file #35111)

Kostya Serebryany <kcc>
Group Member
Thu 08 Oct 2015 09:18:44 PM UTC, comment #3: 

Again a different font format (PCF this time).  Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Thu 08 Oct 2015 07:49:49 PM UTC, comment #2: 

attached 4 more similar reproducers, still unfixed.

Kostya Serebryany <kcc>
Group Member
Thu 08 Oct 2015 07:33:42 PM UTC, comment #1: 

Yep, similar, but different font format.  Thanks for the report, now fixed in git.

Werner LEMBERG <wl>
Group administrator
Thu 08 Oct 2015 05:49:09 PM UTC, original submission:  

found with libFuzzer in 32-bit mode
Similar to #46150, but I see it after the fix for it.
Repro attached.

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35111:  crash-a671c4146385ba3bba0ddb23dca46e7d9ff4ec9b added by kcc (2KiB - application/octet-stream)
file #35107:  crash-19491c00d5274d72c7339e1c77af037f7dabefa2 added by kcc (1KiB - application/octet-stream - few more reproducers, still unfixed.)
file #35108:  crash-3124971d9e4464992b09c8766f07671f0ecb3c3c added by kcc (1KiB - application/octet-stream - few more reproducers, still unfixed.)
file #35109:  crash-568c73cba36d9ad558359d92870b25026f0d67b2 added by kcc (790B - application/octet-stream - few more reproducers, still unfixed.)
file #35110:  crash-8625327c9e9f2dcc44486d0beed1d7310f88abe0 added by kcc (491B - application/octet-stream - few more reproducers, still unfixed.)
file #35106:  crash-c006ef923e5615589094e893c062caa18a2bc84e added by kcc (11KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 15 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-09 wl StatusNone Fixed
    2015-10-08 kcc StatusFixed None
    2015-10-08 kcc Attached File- Added crash-a671c4146385ba3bba0ddb23dca46e7d9ff4ec9b, #35111
    2015-10-08 wl StatusNone Fixed
    2015-10-08 kcc StatusFixed None
    2015-10-08 kcc Attached File- Added crash-19491c00d5274d72c7339e1c77af037f7dabefa2, #35107
        Attached File- Added crash-3124971d9e4464992b09c8766f07671f0ecb3c3c, #35108
        Attached File- Added crash-568c73cba36d9ad558359d92870b25026f0d67b2, #35109
        Attached File- Added crash-8625327c9e9f2dcc44486d0beed1d7310f88abe0, #35110
    2015-10-08 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-08 kcc Summary12K input sonsumes 2.5Gb RAM in 32-bit mode 12K input consumes 2.5Gb RAM in 32-bit mode
    2015-10-08 kcc Attached File- Added crash-c006ef923e5615589094e893c062caa18a2bc84e, #35106

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code