Created attachment 8726852 [details] test_case.ttf This was found while fuzzing graphite2 latest revision (520d76818052772d614e581dacea69499b912be6) This font takes a very long time to process. Fixing this bug will also help improve fuzzing efforts. I am hiding this bug because of the large number of bugs that have been found and I would like to avoid any unwanted attention until things calm down. To reproduce run: ./gr2fonttest test_case.ttf -auto
Keywords: sec-other → sec-low
This isn't a crash it's a large growth. In fact the input string is multiplied by 128. This is within the design limit of a maximum allowed growth factor of 256. The use of gr2fonttest -auto is not representative of typical firefox usage which typically passes strings of length one word. Even with full paragraph rendering, the result is merely a slow down in rendering. If a 256 multiplication is felt to be too high, I'm open to discussion on lowering it.
BTW running this test (with -noprint) under debug and asan gives a 10s runtime but under release conditions 0.16s on my machine. So it may not be as bad as it looks in the fuzzer.
3 years ago
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
status-firefox45: --- → wontfix
status-firefox46: --- → fixed
status-firefox47: --- → fixed
status-firefox48: --- → fixed
status-firefox-esr38: --- → fixed
status-firefox-esr45: --- → fixed
tracking-firefox-esr38: --- → 46+
tracking-firefox-esr45: --- → 46+
status-firefox-esr38: fixed → disabled
status-firefox-esr45: fixed → disabled
You need to log in before you can comment on or make changes to this bug.