graphite2: hang while processing font

RESOLVED FIXED

Status

()

RESOLVED FIXED
3 years ago
2 years ago

People

(Reporter: tsmith, Unassigned)

Tracking

(Blocks: 1 bug, {csectype-dos, sec-low, testcase})

unspecified
csectype-dos, sec-low, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox45 disabled, firefox46 fixed, firefox47 fixed, firefox48 fixed, firefox-esr3846+ disabled, firefox-esr4546+ disabled)

Details

(Whiteboard: [gfx-noted])

Attachments

(1 attachment)

Created attachment 8726852 [details]
test_case.ttf

This was found while fuzzing graphite2 latest revision (520d76818052772d614e581dacea69499b912be6)

This font takes a very long time to process. Fixing this bug will also help improve fuzzing efforts.

I am hiding this bug because of the large number of bugs that have been found and I would like to avoid any unwanted attention until things calm down.

To reproduce run:
./gr2fonttest test_case.ttf -auto
Keywords: sec-other → sec-low

Comment 1

3 years ago
This isn't a crash it's a large growth. In fact the input string is multiplied by 128. This is within the design limit of a maximum allowed growth factor of 256. The use of gr2fonttest -auto is not representative of typical firefox usage which typically passes strings of length one word. Even with full paragraph rendering, the result is merely a slow down in rendering. If a 256 multiplication is felt to be too high, I'm open to discussion on lowering it.
Keywords: crash

Comment 2

3 years ago
BTW running this test (with -noprint) under debug and asan gives a 10s runtime but under release conditions 0.16s on my machine. So it may not be as bad as it looks in the fuzzer.
Whiteboard: [gfx-noted]
Depends on: 1255158
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
status-firefox45: --- → wontfix
status-firefox46: --- → fixed
status-firefox47: --- → fixed
status-firefox48: --- → fixed
status-firefox-esr38: --- → fixed
status-firefox-esr45: --- → fixed
tracking-firefox-esr38: --- → 46+
tracking-firefox-esr45: --- → 46+
status-firefox45: wontfix → disabled
status-firefox-esr38: fixed → disabled
status-firefox-esr45: fixed → disabled
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.