bugThe FreeType Project - Bugs: bug #46254, timeout in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #46254: timeout in af_get_coverage->harfbuzz

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Mon 19 Oct 2015 09:40:35 PM UTC  
Severity:  3 - Normal Item Group:  None
Status:  Invalid Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  None

Fri 23 Oct 2015 05:37:11 AM UTC, comment #4: 

Hmm, older versions should be just fine.  Maybe we have again a 64bit issue that I'm not (yet) able to reproduce?

HarfBuzz is only needed for a very small portion of code in the auto-hinter (functions `af_get_coverage' and `af_get_char_index'), so building FreeType without HarfBuzz doesn't lose much.  On the other hand, FreeType's use of HarfBuzz is very special, and I'm not sure whether any other library or application built on top of HarfBUzz uses this functionality – mainly `hb_ot_layout_lookup_collect_glyphs' – since Behdad developed this particular code for FreeType (and ttfautohint).

In other words, it does make sense to run the fuzzer on FreeType with activated HarfBuzz support.  However, the load flag `FT_LOAD_FORCE_AUTOHINT' should be set then to make every outline font be handled by the auto-hinter.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 22 Oct 2015 08:52:53 PM UTC, comment #3: 

I've added --with-harfbuzz=no to the build script on the
fuzzer bot to make the bot faster.

We are fuzzing harfbuzz separately and anyway the system
harfbuzz is not instrumented and too old to be interesting.

Does this disable a very significant part of FreeType functionality?
If yes, we may need to find a way to run the fuzzer with a fresh harfbuzz. (build them together?)

Kostya Serebryany <kcc>
Project Member
Thu 22 Oct 2015 08:28:28 PM UTC, comment #2: 

On Ubuntu 14.04 I have:
/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0 -> libharfbuzz.so.0.927.0

Does this mean that my system libharfbuzz is just too old?

Kostya Serebryany <kcc>
Project Member
Tue 20 Oct 2015 08:45:40 PM UTC, comment #1: 

Still using harfbuzz 1.0.1, FreeType's current git runs just fine, without hanging.  I'm closing it as invalid.  Please reopen if necessary.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 19 Oct 2015 09:40:35 PM UTC, original submission:  

Found by the libFuzzer bot.

The attached reproducer hangs somewhere inside harfbuzz,
which might be a bug there (see e.g. https://github.com/behdad/harfbuzz/issues/139#issuecomment-148870917) or it could be a misuse of harfbuzz.

In either case it hurts FreeType (and its fuzzing process).

==14850== ERROR: libFuzzer: timeout after 1436 seconds
    #0 0x4c62f1 in __sanitizer_print_stack_trace /home/kcc/llvm/projects/compiler-rt/lib/asan/asan_stack.cc:38
    #1 0x6776c4 in fuzzer::Fuzzer::AlarmCallback() (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x6776c4)
    #2 0x67752c in fuzzer::Fuzzer::StaticAlarmCallback() (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x67752c)
    #3 0x6877b7 in fuzzer::AlarmHandler(int, siginfo_t*, void*) (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x6877b7)
    #4 0x7f5477fc833f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1033f)
    #5 0x7f54787f943a  (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x1943a)
    #6 0x7f5478806025  (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x26025)
    #40 0x7f54787f71d5 in hb_ot_layout_lookup_collect_glyphs (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x171d5)
    #41 0x509127 in af_get_coverage /home/kcc/freetype2/src/autofit/hbshim.c:198:7
    #42 0x52c643 in af_face_globals_compute_style_coverage /home/kcc/freetype2/src/autofit/afglobal.c:248:5
    #43 0x52c643 in af_face_globals_new /home/kcc/freetype2/src/autofit/afglobal.c:363
    #44 0x50b329 in af_loader_reset /home/kcc/freetype2/src/autofit/afloader.c:54:15
    #45 0x50b329 in af_loader_load_glyph /home/kcc/freetype2/src/autofit/afloader.c:357
    #46 0x50b329 in af_autofitter_load_glyph /home/kcc/freetype2/src/autofit/afmodule.c:372
    #47 0x5b4852 in FT_Load_Glyph /home/kcc/freetype2/src/base/ftobjs.c:733:19

Kostya Serebryany <kcc>
Project Member


Attached Files
file #35233:  timeout-70ce9e18607d0a8d2959ad5cb34ac826bcea343b added by kcc (11KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-20 wl StatusNone => Invalid
        Assigned toNone => wl
        Open/ClosedOpen => Closed
    2015-10-19 kcc Attached File- => Added timeout-70ce9e18607d0a8d2959ad5cb34ac826bcea343b, #35233

    Back to the top

    Powered by Savane 3.6