1253679 - graphite2: hang while processing font

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

This was found while fuzzing graphite2 latest revision (520d76818052772d614e581dacea69499b912be6)

This font takes a very long time to process. Fixing this bug will also help improve fuzzing efforts.

I am hiding this bug because of the large number of bugs that have been found and I would like to avoid any unwanted attention until things calm down.

To reproduce run:
./gr2fonttest test_case.ttf -auto

Comment 1

[martin_hosken]

This isn't a crash it's a large growth. In fact the input string is multiplied by 128. This is within the design limit of a maximum allowed growth factor of 256. The use of gr2fonttest -auto is not representative of typical firefox usage which typically passes strings of length one word. Even with full paragraph rendering, the result is merely a slow down in rendering. If a 256 multiplication is felt to be too high, I'm open to discussion on lowering it.

Comment 2

[martin_hosken]

BTW running this test (with -noprint) under debug and asan gives a 10s runtime but under release conditions 0.16s on my machine. So it may not be as bad as it looks in the fuzzer.

Comment 3

[Daniel Veditz [:dveditz]]

Graphite2 has been updated on all affected branches including ESRs.