1253692 - graphite2: stack-overflow in [@graphite2::Slot::floodShift] Slot.cpp:493

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Found in graphite2 revision 520d76818052772d614e581dacea69499b912be6

The unstoppable zombie bug! (also see bug 1252724) This bug is impacting our ability to fuzz graphite.

./gr2fonttest <test> -auto

==20577==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc440b6ff8 (pc 0x0000004c06e4 bp 0x7f47e49ca7f4 sp 0x7ffc440b7000 T0)
    #0 0x4c06e3 in __asan::GetCurrentThread() /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264
    #1 0x42c072 in __tls_get_addr /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4095
    #2 0x7f47e459cdc8 in graphite2::Position::operator+=(graphite2::Position const&) /home/user/code/graphite/src/inc/Position.h:39:56
    #3 0x7f47e459cdc8 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:492
    #4 0x7f47e459ceb7 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:493:18
    ...
    #252 0x7f47e459ceb7 in graphite2::Slot::floodShift(graphite2::Position) /home/user/code/graphite/src/Slot.cpp:493:18

SUMMARY: AddressSanitizer: stack-overflow /home/user/Desktop/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:264 in __asan::GetCurrentThread()
==20577==ABORTING

Comment 1

[martin_hosken]

Fixed? in bf21538ced7cf328e6bec0c7538da9010b93e7db also added -noprint which may speed up fuzzing a smidgen. Saves all that growth being output.

Comment 2

[Tyson Smith [:tsmith]]

Verified with graphite revision bf21538ced7cf328e6bec0c7538da9010b93e7db

Thanks Martin, I'll try out the new flag.

Comment 3

[Daniel Veditz [:dveditz]]

Graphite2 has been updated on all affected branches including ESRs.