bugThe FreeType Project - Bugs: bug #45987, 512 byte input consumes 1.7Gb / 2...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45987: 512 byte input consumes 1.7Gb / 2 sec to process

Submitter:  Kostya Serebryany <kcc>
Submitted:  Thu 17 Sep 2015 04:00:10 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.1

Sat 19 Sep 2015 10:44:31 AM UTC, comment #3: 

Fixed now in git, thanks.

Note that the gdb backtrace would be much more helpful if you compiled FreeType with something like `-O0 -g3'...

Werner LEMBERG <wl>
Group administrator
Fri 18 Sep 2015 06:59:05 PM UTC, comment #2: 

#0  FT_Stream_EnterFrame (stream=stream@entry=0x16a0b90, count=1812070520) at src/base/ftstream.c:236
        error = <optimized out>
        read_bytes = <optimized out>
#1  0x000000000041a3a8 in tt_face_load_cvt (face=face@entry=0x16a0bf0, stream=stream@entry=0x16a0b90) at src/truetype/ttpload.c:309
        error = <optimized out>
        memory = 0x16a0010
        table_len = 1812070521
#2  0x000000000041b6df in tt_face_init (stream=0x16a0b90, ttface=<optimized out>, face_index=<optimized out>, num_params=<optimized out>, params=<optimized out>)
    at src/truetype/ttobjs.c:585
        error = <optimized out>
        library = <optimized out>
        sfnt = <optimized out>
        face = <optimized out>
#3  0x0000000000410c32 in open_face (driver=driver@entry=0x16a01c0, astream=astream@entry=0x7fffffffdb58, external_stream=external_stream@entry=0 '\000', face_index=face_index@entry=0,
    num_params=0, params=0x0, aface=aface@entry=0x7fffffffdb60) at src/base/ftobjs.c:1166
        memory = 0x16a0010
        clazz = 0x46fe20 <tt_driver_class>
        face = 0x16a0bf0
        internal = 0x16a1120
        error = 0
        error2 = <optimized out>
#4  0x00000000004113ab in FT_Open_Face (library=0x16a0040, args=args@entry=0x7fffffffdd50, face_index=<optimized out>, aface=0x7fffffffdda8)
    at src/base/ftobjs.c:2157
        num_params = <optimized out>
        params = <optimized out>
        error = 11
        driver = 0x16a01c0
        memory = 0x16a0010
        stream = 0x16a0b90
        face = 0x0
        node = 0x0
        external_stream = 0 '\000'
        cur = 0x16a0058
        limit = <optimized out>
#5  0x0000000000412234 in FT_New_Memory_Face (library=<optimized out>, file_base=<optimized out>, file_size=<optimized out>, face_index=<optimized out>, aface=<optimized out>)
    at src/base/ftobjs.c:1256
        args = {flags = 1, memory_base = 0x16a0980 "", memory_size = 512, pathname = 0x7fffffffde10 "", stream = 0x0, driver = 0x7ffff7df0515 <_dl_runtime_resolve+53>, num_params = 23726464,
          params = 0x7ffff752f760 <main_arena>}

Kostya Serebryany <kcc>
Group Member
Thu 17 Sep 2015 04:17:20 PM UTC, comment #1: 

This is a 64bit bug that I can't reproduce on my machine (for me, only 2616 bytes are allocated in 36 allocs).  Please set a breakpoint at the offending `FT_Stream_EnterFrame' call and post a `bt full' output so that I get more details.

Werner LEMBERG <wl>
Group administrator
Thu 17 Sep 2015 04:00:10 AM UTC, original submission:  

.. and it probably shouldn't.
Not sure if you treat this as a bug, but at the very least it hurts fuzzing.
I've got more cases where it consumes 3Gb+, 4Gb+ and so on,
I'll report those once this bug is fixed (and if they are still there)

Found with libFuzzer.

Feed the input below to FT_New_Memory_Face,
it will consume 1.7 Gb RAM and 2+ seconds of CPU time.

FT_Stream_EnterFrame: invalid i/o; pos = 0x1fc, count = 16, size = 0x200
FT_Stream_EnterFrame: invalid i/o; pos = 0x100, count = 1812070520, size = 0x200
2.23user 2.36system 0:04.62elapsed 99%CPU (0avgtext+0avgdata 1770892maxresident)k
0inputs+0outputs (0major+3252minor)pagefaults 0swaps



AAEAAABbAIAAAwCoOlMvMoLSlpwAAAE4AAAAYGNtYXBpIBkAAAABoAAAAEBjdnQgABQAAAAAAeAA
AAAAZ2x5Zn4+fDwAAAHsAAAAamhlYWTcx2BBAAAAvAAAADZoaGVhhAO+BAAAAPQAAABkaG10eFoA
QAYAAAGYAAAACGxvY2EwAAAAAAAB5AAAAAZtYXhwfAEBDwAAAhgAACogbmFtZX1wKfndAAACWIwA
AAFNc2IAAQAAAAsAgAADAKhPUy8ygtKWnAAAATgAAABgY21hcGkAGQAAAAGgAAAAQGN2dCAAFAAA
AAABAGwCAHln4ABpeI9+WpgAAEPEAAAAQAABAAAAAQAAlrW58l8PPPUACQPoAAAAAMfDi3AAAAAA
x9FaEABaAAACxgMgAAAACQACZn4+fDwAAAHsAAAAamhlYWTdx2BBAAAAvAAAADZoaGVhhAO+BAAA
APQAAAAkaG10eFoAQAYAAAGYAAAACGxvY2ExAAAAAAAAAAAAAAAAAQAA7gkg/wIDBgAAAABaAsYA
AQAAAAAAAAAAAAAAAAAAAAIAAAIAAAEACAACAAAAAAABAAAAAAAKAAACAAFzAAAAAAADAxoBkAAF
AAQCvAKKAPsAjQK8AooAAAHkAAAABm1heHB8AQ8CAAABGAAAACBuYW1lfXD53QAAAlgAAAFsc2I=

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-09-19 wl StatusNeed Info Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.1
    2015-09-17 wl StatusNone Need Info
        Assigned toNone wl

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code