Closed Bug 1253679 Opened 8 years ago Closed 8 years ago

graphite2: hang while processing font

Categories

(Core :: Graphics: Text, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
firefox45 --- disabled
firefox46 --- fixed
firefox47 --- fixed
firefox48 --- fixed
firefox-esr38 46+ disabled
firefox-esr45 46+ disabled

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-dos, sec-low, testcase, Whiteboard: [gfx-noted])

Attachments

(1 file)

1.62 KB, application/x-font-ttf
Details
Attached file test_case.ttf
This was found while fuzzing graphite2 latest revision (520d76818052772d614e581dacea69499b912be6)

This font takes a very long time to process. Fixing this bug will also help improve fuzzing efforts.

I am hiding this bug because of the large number of bugs that have been found and I would like to avoid any unwanted attention until things calm down.

To reproduce run:
./gr2fonttest test_case.ttf -auto
Keywords: sec-othersec-low
This isn't a crash it's a large growth. In fact the input string is multiplied by 128. This is within the design limit of a maximum allowed growth factor of 256. The use of gr2fonttest -auto is not representative of typical firefox usage which typically passes strings of length one word. Even with full paragraph rendering, the result is merely a slow down in rendering. If a 256 multiplication is felt to be too high, I'm open to discussion on lowering it.
Keywords: crash
BTW running this test (with -noprint) under debug and asan gives a 10s runtime but under release conditions 0.16s on my machine. So it may not be as bad as it looks in the fuzzer.
Whiteboard: [gfx-noted]
Depends on: 1255158
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.