bugThe FreeType Project - Bugs: bug #56586, Undefined-shift (OSS-Fuzz 9999)


You are not allowed to post comments on this tracker with your current authentication level.

bug #56586: Undefined-shift (OSS-Fuzz 9999)

Submitter:  Dirk Lemstra <dlemstra>
Submitted:  Sun 07 Jul 2019 01:18:34 PM UTC
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  podtelez Open/Closed:  Closed
Planned Release:  2.10.2

Wed 24 Jul 2019 02:42:07 AM UTC, comment #3: 
Alexei Podtelezhnikov <podtelez>
Group Member
Tue 09 Jul 2019 05:41:34 PM UTC, comment #2: 

It's either multiply by shifted one or remove upscaling. I am not sure if upscaling is even necessary.

Alexei Podtelezhnikov <podtelez>
Group Member
Sun 07 Jul 2019 01:46:17 PM UTC, comment #1: 

Alexei, please take care.  This is your code :-)

Werner LEMBERG <wl>
Group administrator
Sun 07 Jul 2019 01:18:34 PM UTC, original submission:  

The ImageMagick project is using https://github.com/google/oss-fuzz to find bugs in our own library and in libraries that we use. The fuzzer found an issue and we think this is an issue that should be resolved in the library that we use. This issue is posted under the url https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9999. Below are the details of the issue that can be reproduced using the following technique: https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md.


/src/freetype2/src/base/ftbbox.c:297:10: runtime error: left shift of negative value -372
  #0 0xcf1771 in cubic_peak /src/freetype2/src/base/ftbbox.c:297:10
  #1 0xcf0f29 in BBox_Cubic_Check /src/freetype2/src/base/ftbbox.c:374:15
  #2 0xcf0d2a in BBox_Cubic_To /src/freetype2/src/base/ftbbox.c:435:7
  #3 0xce6629 in FT_Outline_Decompose /src/freetype2/src/base/ftoutln.c:249:23
  #4 0xcf0856 in FT_Outline_Get_BBox /src/freetype2/src/base/ftbbox.c:518:15
  #5 0x51b27d in RenderFreetype imagemagick/MagickCore/annotate.c:1589:15
  #6 0x518e11 in GetTypeMetrics imagemagick/MagickCore/annotate.c:873:10
  #7 0x586610 in RenderMVGContent imagemagick/MagickCore/draw.c:4294:17
  #8 0x7d63a2 in ReadTTFImage imagemagick/coders/ttf.c:289:10
  #9 0x5632b1 in ReadImage imagemagick/MagickCore/constitute.c:547:15
  #10 0x7e688d in ExtractPostscript imagemagick/coders/wpg.c:849:10
  #11 0x7e5574 in ReadWPGImage imagemagick/coders/wpg.c:1553:25
  #12 0x5632b1 in ReadImage imagemagick/MagickCore/constitute.c:547:15
  #13 0x6a543b in ReadStream imagemagick/MagickCore/stream.c:1043:9
  #14 0x52ab64 in PingBlob imagemagick/MagickCore/blob.c:3607:13
  #15 0x4a200f in Magick::Image::ping(Magick::Blob const&) imagemagick/Magick++/lib/Image.cpp:3860:12
  #16 0x42b75f in LLVMFuzzerTestOneInput imagemagick/Magick++/fuzz/ping_fuzzer.cc:43:11
  #17 0x4464ae in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:553:15
  #18 0x42c702 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:292:6
  #19 0x43083e in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:775:9
  #20 0x42c46a in main /src/libfuzzer/FuzzerMain.cpp:19:10
  #21 0x7fa86de7382f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291
  #22 0x40a2d8 in _start

Links: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/base/ftbbox.c?id=05439f5cc69eaa3deaf3db52a7999af09a2c293a#n297

Commit: 05439f5cc69eaa3deaf3db52a7999af09a2c293a

Dirk Lemstra <dlemstra>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by dlemstra (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-08-22 wl PrivacyPrivate Public
    2019-07-24 podtelez StatusNone Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.2
    2019-07-07 wl Assigned toNone podtelez
    2019-07-07 dlemstra Attached File- Added clusterfuzz-testcase-minimized-ping_wpg_fuzzer-4867356412084224, #47168

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code