graphite2: hang while processing font




3 years ago
2 years ago


(Reporter: tsmith, Unassigned)


(Blocks: 1 bug, {csectype-dos, sec-low, testcase})

csectype-dos, sec-low, testcase
Dependency tree / graph

Firefox Tracking Flags

(firefox45 disabled, firefox46 fixed, firefox47 fixed, firefox48 fixed, firefox-esr3846+ disabled, firefox-esr4546+ disabled)


(Whiteboard: [gfx-noted])


(1 attachment)

Created attachment 8726852 [details]

This was found while fuzzing graphite2 latest revision (520d76818052772d614e581dacea69499b912be6)

This font takes a very long time to process. Fixing this bug will also help improve fuzzing efforts.

I am hiding this bug because of the large number of bugs that have been found and I would like to avoid any unwanted attention until things calm down.

To reproduce run:
./gr2fonttest test_case.ttf -auto
Keywords: sec-other → sec-low

Comment 1

3 years ago
This isn't a crash it's a large growth. In fact the input string is multiplied by 128. This is within the design limit of a maximum allowed growth factor of 256. The use of gr2fonttest -auto is not representative of typical firefox usage which typically passes strings of length one word. Even with full paragraph rendering, the result is merely a slow down in rendering. If a 256 multiplication is felt to be too high, I'm open to discussion on lowering it.
Keywords: crash

Comment 2

3 years ago
BTW running this test (with -noprint) under debug and asan gives a 10s runtime but under release conditions 0.16s on my machine. So it may not be as bad as it looks in the fuzzer.
Whiteboard: [gfx-noted]
Depends on: 1255158
Last Resolved: 2 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
status-firefox45: --- → wontfix
status-firefox46: --- → fixed
status-firefox47: --- → fixed
status-firefox48: --- → fixed
status-firefox-esr38: --- → fixed
status-firefox-esr45: --- → fixed
tracking-firefox-esr38: --- → 46+
tracking-firefox-esr45: --- → 46+
status-firefox45: wontfix → disabled
status-firefox-esr38: fixed → disabled
status-firefox-esr45: fixed → disabled
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.