Closed Bug 1253692 Opened 8 years ago Closed 8 years ago

graphite2: stack-overflow in [@graphite2::Slot::floodShift] Slot.cpp:493

Categories

(Core :: Graphics: Text, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
firefox45 --- disabled
firefox46 --- fixed
firefox47 --- fixed
firefox48 --- fixed
firefox-esr38 46+ disabled
firefox-esr45 46+ disabled

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [gfx-noted])

Attachments

(1 file)

1.64 KB, application/x-font-ttf
Details
Attached file test_case.ttf
Found in graphite2 revision 520d76818052772d614e581dacea69499b912be6

The unstoppable zombie bug! (also see bug 1252724) This bug is impacting our ability to fuzz graphite.

./gr2fonttest <test> -auto

==20577==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc440b6ff8 (pc 0x0000004c06e4 bp 0x7f47e49ca7f4 sp 0x7ffc440b7000 T0)
    #0 0x4c06e3 in __asan::GetCurrentThread() /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264
    #1 0x42c072 in __tls_get_addr /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4095
    #2 0x7f47e459cdc8 in graphite2::Position::operator+=(graphite2::Position const&) /home/user/code/graphite/src/inc/Position.h:39:56
    #3 0x7f47e459cdc8 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:492
    #4 0x7f47e459ceb7 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:493:18
    ...
    #252 0x7f47e459ceb7 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:493:18

SUMMARY: AddressSanitizer: stack-overflow /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264 in __asan::GetCurrentThread()
==20577==ABORTING
Fixed? in bf21538ced7cf328e6bec0c7538da9010b93e7db also added -noprint which may speed up fuzzing a smidgen. Saves all that growth being output.
Verified with graphite revision bf21538ced7cf328e6bec0c7538da9010b93e7db

Thanks Martin, I'll try out the new flag.
Whiteboard: [gfx-noted]
Depends on: 1255158
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Graphite2 has been updated on all affected branches including ESRs.
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.