Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panic in CFF parsing and Entry::PrivateDictRange #986

Open
drott opened this issue Jul 3, 2024 · 0 comments
Open

Panic in CFF parsing and Entry::PrivateDictRange #986

drott opened this issue Jul 3, 2024 · 0 comments

Comments

@drott
Copy link
Contributor

drott commented Jul 3, 2024

From
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69991
https://oss-fuzz.com/testcase-detail/5933171414204416

#11 0x56f83d6a91c2 in core::panicking::panic::h93f2974d1a0ad31d /rustc/1a648b397dedc98ada3dd3360f6d661ec2436c56/library/core/src/panicking.rs:144:5
    #12 0x56f83dcb44a0 in read_fonts::tables::postscript::dict::parse_entry::hb389cc76a0b045d3 [fontations/read-fonts/src/tables/postscript/dict.rs:337](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/read-fonts/src/tables/postscript/dict.rs#L337):44
    #13 0x56f83d83644b in read_fonts::tables::postscript::dict::entries::_$u7b$$u7b$closure$u7d$$u7d$::hae4e7ccb09d4f1b9 [fontations/read-fonts/src/tables/postscript/dict.rs:311](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/read-fonts/src/tables/postscript/dict.rs#L311):29
    #14 0x56f83d8ea684 in _$LT$core..iter..sources..from_fn..FromFn$LT$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h9c586c445534e9e8 /rustc/1a648b397dedc98ada3dd3360f6d661ec2436c56/library/core/src/iter/sources/from_fn.rs:69:9
    #15 0x56f83d8ea684 in skrifa::outline::cff::TopDict::new::h27db21f149f61fc8 [fontations/skrifa/src/outline/cff/mod.rs:349](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/skrifa/src/outline/cff/mod.rs#L349):22

Entry::PrivateDictRange(start..start + len) leads to a panic probably because both values are taken verbatim from the font file and produce and out of range access.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant