1261135 - graphite2: use of uninitialized memory in [@graphite2::Pass::testConstraint]

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

This was found while fuzzing graphite2 revision 313b775d1b80d5a238eff846716ee46e971ef065 (>1.3.8)

To reproduce run:
valgrind -q ./gr2fonttest test_case.ttf -auto -demand -noprint

Conditional jump or move depends on uninitialised value(s)
   at 0x4E5E2BE: graphite2::Pass::testConstraint(graphite2::Rule const&, graphite2::vm::Machine&) const (Pass.cpp:642)
   by 0x4E5D648: graphite2::Pass::findNDoRule(graphite2::Slot*&, graphite2::vm::Machine&, graphite2::FiniteStateMachine&) const (Pass.cpp:509)
   by 0x4E5D033: graphite2::Pass::runGraphite(graphite2::vm::Machine&, graphite2::FiniteStateMachine&, bool) const (Pass.cpp:417)
   by 0x4E66150: graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const (Silf.cpp:423)
   by 0x4E50C27: graphite2::Face::runGraphite(graphite2::Segment*, graphite2::Silf const*) const (Face.cpp:180)
   by 0x4E415E7: graphite2::Segment::runGraphite() (in /home/user/Desktop/graphite/libgraphite2.so.3)
   by 0x4E40DC3: (anonymous namespace)::makeAndInitialize(graphite2::Font const*, graphite2::Face const*, unsigned int, graphite2::FeatureVal const*, gr_encform, void const*, unsigned long, int) (gr_segment.cpp:46)
   by 0x4E40FDE: gr_make_seg (gr_segment.cpp:105)
   by 0x4044CD: Parameters::testFileFont() const (gr2FontTest.cpp:691)
   by 0x404F22: main (gr2FontTest.cpp:797)
 Uninitialised value was created by a stack allocation
   at 0x4E65B4B: graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const (Silf.cpp:356)

Comment 1

[martin_hosken]

Fixed? in 56157cf9845d13452068c297205f96b946126cc2

Comment 2

[Tyson Smith [:tsmith]]

Verified with graphite revision 56157cf9845d13452068c297205f96b946126cc2

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: Cherry-pick commit 56157cf9845d13452068c297205f96b946126cc2 from graphite2 upstream

This is simple enough that I think we should just go ahead and take it, without needing to wait for a further upstream release.

Comment 4

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6af7c50ac3d3822f86f7ed8e17b59f0520346a0a
Bug 1261135 - Cherry-pick commit 56157cf9845d13452068c297205f96b946126cc2 from graphite2 upstream. r=jrmuizel

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6af7c50ac3d3