search

caryll / otfcc

Optimized OpenType builder and inspector.
Apache License 2.0
422 stars 63 forks source link

SIGSEGV when feeding otfccdump with crafted otf file #60

Closed hongxuchen closed 5 years ago

hongxuchen commented 5 years ago

As of 48e5245, when feeding otfccdump with some crafted otf files, it may crash with backtrace like:

$ gdb --args ~/FOT/otfcc-debug/bin/debug-x64/otfccdump c01.otf
Reading symbols from /home/hongxu/FOT/otfcc-debug/bin/debug-x64/otfccdump...done.
gdb$ run
Starting program: /home/hongxu/FOT/otfcc-debug/bin/debug-x64/otfccdump c01.otf

Program received signal SIGSEGV, Segmentation fault.
0x000055555556920a in readOtf (_sfnt=0x5555558406c0, index=0x0, options=0x555555840260) at ../../lib/otf-reader/otf-reader.c:43
43                              GlyfIOContext ctx = {.locaIsLong = font->head->indexToLocFormat,
gdb$ bt
#0  0x000055555556920a in readOtf (_sfnt=0x5555558406c0, index=0x0, options=0x555555840260) at ../../lib/otf-reader/otf-reader.c:43
#1  0x0000555555565c51 in main (argc=0x2, argv=0x7fffffffbef8) at ../../src/otfccdump.c:199

poc.zip

The binary is compiled with default debug_x64 config; for other compilations such as -O0 -fsanitize=address, it may hang with infinite loop.