Closed Bug 1252724 Opened 8 years ago Closed 8 years ago

graphite2: stack-overflow in [@graphite2::Slot::floodShift] Slot.cpp:495

Categories

(Core :: Graphics: Text, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
firefox45 --- disabled
firefox46 --- fixed
firefox47 --- fixed
firefox48 --- fixed
firefox-esr38 46+ disabled
firefox-esr45 46+ disabled

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [gfx-noted])

Attachments

(1 file)

143.04 KB, application/x-font-ttf
Details
Attached file test_case.ttf
Found in graphite2 revision bc5409c573aa9ecccacd18cf713021272998cd35

./gr2fonttest <test> -auto

==53848==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe2186bff8 (pc 0x0000004c06e4 bp 0x7f7e9d53d7f4 sp 0x7ffe2186c000 T0)
    #0 0x4c06e3 in __asan::GetCurrentThread() /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264
    #1 0x42c072 in __tls_get_addr /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4095
    #2 0x7f7e9d10fc38 in graphite2::Position::operator+=(graphite2::Position const&) /home/user/code/graphite/src/inc/Position.h:39:56
    #3 0x7f7e9d10fc38 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:495
    ...
    #252 0x7f7e9d10fd27 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:496:18

SUMMARY: AddressSanitizer: stack-overflow /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264 in __asan::GetCurrentThread()
==53848==ABORTING
Hi Martin, Could you have a look at this issue as soon as possible? It is slowing our fuzzing efforts. Thanks!
Flags: needinfo?(martin_hosken)
yes it's being a pain for us too. Working on it now, but it's not a nice one. Could well be linked with 1253501 and 1252763. BTW these are the only unfixed ones, I think.
Flags: needinfo?(martin_hosken)
fixed? in 520d76818052772d614e581dacea69499b912be6
Verified with graphite revision 520d76818052772d614e581dacea69499b912be6
See Also: → 1253692
Whiteboard: [gfx-noted]
Depends on: 1255158
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.