convert_woff2ttf_fuzzer hits timeout in woff2::ConvertWOFF2ToTTF(), also it looks like an infinite (or very long) looping with leaking memory.

Reproduction steps:
1) Build 'convert_woff2ttf_fuzzer' target using this instruction https://sites.google.com/a/chromium.org/dev/developers/testing/libfuzzer
2) Run it with the following parameter (file is attached):
./convert_woff2ttf_fuzzer ./15746eb767d56faf4396fd5f5e6c8f3ddb605a5f -print_final_stats=1 -timeout=10

The output will be like:
ALARM: working on the last Unit for 11 seconds
       and the timeout value is 10 (use -timeout=N to change)
==16693== ERROR: libFuzzer: timeout after 11 seconds
<...>
    #7 0x4ef64d in std::__1::vector<unsigned char, std::__1::allocator<unsigned char> >::vector(unsigned long) buildtools/third_party/libc++/trunk/include/vector:1073
    #8 0x4e1a9b in woff2::ConvertWOFF2ToTTF(unsigned char const*, unsigned long, woff2::WOFF2Out*) third_party/woff2/src/woff2_dec.cc:1274:24
    #9 0x4dbc66 in LLVMFuzzerTestOneInput testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc:15:3
<...>
SUMMARY: libFuzzer: timeout
stat::number_of_executed_units: 0
stat::average_exec_per_sec:     0
stat::new_units_added:          0
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              809


Using bigger timeout arguments gives the same result, but amount of memory used raises:

20 sec:
stat::peak_rss_mb:              1119

60 sec:
stat::peak_rss_mb:              2404

etc. Testcase attached.

 

Deleted: 15746eb767d56faf4396fd5f5e6c8f3ddb605a5f 1.6 KB

15746eb767d56faf4396fd5f5e6c8f3ddb605a5f 1.6 KB View Download