Open Bug 1459757 Opened 6 years ago Updated 2 years ago

graphite2: crash at null in [@ graphite2::Segment::delLineEnd]

Categories

(Core :: Graphics: Text, defect, P3)

defect

Tracking

()

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Attachments

(1 file)

6.06 KB, application/x-font-ttf
Details
Attached file testcase.fuzz
Found with graphite commit edeb6b92d93aca07df457d81a1d728a799a54350

==9994==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052a905 bp 0x7ffc5b49e810 sp 0x7ffc5b49e6c0 T0)
==9994==The signal is caused by a WRITE memory access.
==9994==Hint: address points to the zero page.
    #0 0x52a904 in graphite2::Slot::next(graphite2::Slot*) src/inc/Slot.h:85:33
    #1 0x52a904 in graphite2::Segment::delLineEnd(graphite2::Slot*) src/Justifier.cpp:274
    #2 0x52a904 in graphite2::Segment::justify(graphite2::Slot*, graphite2::Font const*, float, graphite2::justFlags, graphite2::Slot*, graphite2::Slot*) src/Justifier.cpp:228
    #3 0x511303 in LLVMFuzzerTestOneInput tests/fuzz-tests/gr-fuzzer-segment.cpp:115:9
    #4 0x511a24 in main tests/fuzz-tests/gr-fuzzer-segment.cpp:143:7
    #5 0x7f0405a5182f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #6 0x41a3e8 in _start (gr-fuzzer-segment+0x41a3e8)
what command line did you use to exercise this?
Flags: needinfo?(twsmith)
Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1459753#c2
Flags: needinfo?(twsmith)
I had the same kind of problem too. I got so many crashes in lower version of windows in higher version of Windows it works correctly. For the troubleshoot or correction of such kind of errors Visit https://www.delltechsupportnumbers.com/blog/fix-dell-error-code-0xc0000001/
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.