bugThe FreeType Project - Bugs: bug #46254, timeout in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46254: timeout in af_get_coverage->harfbuzz

Submitter:  Kostya Serebryany <kcc>
Submitted:  Mon 19 Oct 2015 09:40:35 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Invalid Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  None

Fri 23 Oct 2015 05:37:11 AM UTC, comment #4: 

Hmm, older versions should be just fine.  Maybe we have again a 64bit issue that I'm not (yet) able to reproduce?

HarfBuzz is only needed for a very small portion of code in the auto-hinter (functions `af_get_coverage' and `af_get_char_index'), so building FreeType without HarfBuzz doesn't lose much.  On the other hand, FreeType's use of HarfBuzz is very special, and I'm not sure whether any other library or application built on top of HarfBUzz uses this functionality – mainly `hb_ot_layout_lookup_collect_glyphs' – since Behdad developed this particular code for FreeType (and ttfautohint).

In other words, it does make sense to run the fuzzer on FreeType with activated HarfBuzz support.  However, the load flag `FT_LOAD_FORCE_AUTOHINT' should be set then to make every outline font be handled by the auto-hinter.

Werner LEMBERG <wl>
Group administrator
Thu 22 Oct 2015 08:52:53 PM UTC, comment #3: 

I've added --with-harfbuzz=no to the build script on the
fuzzer bot to make the bot faster.

We are fuzzing harfbuzz separately and anyway the system
harfbuzz is not instrumented and too old to be interesting.

Does this disable a very significant part of FreeType functionality?
If yes, we may need to find a way to run the fuzzer with a fresh harfbuzz. (build them together?)

 Kostya Serebryany <kcc>
Group Member
Thu 22 Oct 2015 08:28:28 PM UTC, comment #2: 

On Ubuntu 14.04 I have:
/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0 -> libharfbuzz.so.0.927.0

Does this mean that my system libharfbuzz is just too old?

Kostya Serebryany <kcc>
Group Member
Tue 20 Oct 2015 08:45:40 PM UTC, comment #1: 

Still using harfbuzz 1.0.1, FreeType's current git runs just fine, without hanging.  I'm closing it as invalid.  Please reopen if necessary.

 Werner LEMBERG <wl>
Group administrator
Mon 19 Oct 2015 09:40:35 PM UTC, original submission:  

Found by the libFuzzer bot.

The attached reproducer hangs somewhere inside harfbuzz,
which might be a bug there (see e.g. https://github.com/behdad/harfbuzz/issues/139#issuecomment-148870917) or it could be a misuse of harfbuzz.

In either case it hurts FreeType (and its fuzzing process).



==14850== ERROR: libFuzzer: timeout after 1436 seconds
    #0 0x4c62f1 in __sanitizer_print_stack_trace /home/kcc/llvm/projects/compiler-rt/lib/asan/asan_stack.cc:38
    #1 0x6776c4 in fuzzer::Fuzzer::AlarmCallback() (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x6776c4)
    #2 0x67752c in fuzzer::Fuzzer::StaticAlarmCallback() (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x67752c)
    #3 0x6877b7 in fuzzer::AlarmHandler(int, siginfo_t*, void*) (/home/kcc/fuzz_freetype/freetype2_fuzzer+0x6877b7)
    #4 0x7f5477fc833f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1033f)
    #5 0x7f54787f943a  (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x1943a)
    #6 0x7f5478806025  (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x26025)
...
    #40 0x7f54787f71d5 in hb_ot_layout_lookup_collect_glyphs (/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0+0x171d5)
    #41 0x509127 in af_get_coverage /home/kcc/freetype2/src/autofit/hbshim.c:198:7
    #42 0x52c643 in af_face_globals_compute_style_coverage /home/kcc/freetype2/src/autofit/afglobal.c:248:5
    #43 0x52c643 in af_face_globals_new /home/kcc/freetype2/src/autofit/afglobal.c:363
    #44 0x50b329 in af_loader_reset /home/kcc/freetype2/src/autofit/afloader.c:54:15
    #45 0x50b329 in af_loader_load_glyph /home/kcc/freetype2/src/autofit/afloader.c:357
    #46 0x50b329 in af_autofitter_load_glyph /home/kcc/freetype2/src/autofit/afmodule.c:372
    #47 0x5b4852 in FT_Load_Glyph /home/kcc/freetype2/src/base/ftobjs.c:733:19

 Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35233:  timeout-70ce9e18607d0a8d2959ad5cb34ac826bcea343b added by kcc (11KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-20 wl StatusNone Invalid
        Assigned toNone wl
        Open/ClosedOpen Closed
    2015-10-19 kcc Attached File- Added timeout-70ce9e18607d0a8d2959ad5cb34ac826bcea343b, #35233

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code