New issue
Advanced search Search tips

Issue 824486 link

Starred by 1 user
Status: Untriaged
Owner: ----
Cc:
dnicoara@chromium.org
mmoroz@chromium.org
spang@chromium.org
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Two UBSAN issues in third_party/fontconfig

Project Member Reported by wolenetz@chromium.org, Mar 21 2018 
When locally building a UBSAN chromium fuzzer, I observed the following output (though the build proceeds):

../../third_party/fontconfig/src/src/fcfreetype.c:2333:33: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
    #0 0x4e54ba in FcFreeTypeCharSetAndSpacingForSize third_party/fontconfig/src/src/fcfreetype.c:2333:33
    #1 0x4e352f in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1853:10
    #2 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #3 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #4 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #5 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #6 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #7 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #8 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #9 0x7f3436eca2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #10 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

../../third_party/fontconfig/src/src/ftglue.c:233:28: runtime error: left shift of 245 by 24 places cannot be represented in type 'int'
    #0 0x4f9fd7 in ftglue_face_goto_table third_party/fontconfig/src/src/ftglue.c:233:28
    #1 0x4e6a0f in GetScriptTags third_party/fontconfig/src/src/fcfreetype.c:2557:19
    #2 0x4e44d0 in FcFontCapabilities third_party/fontconfig/src/src/fcfreetype.c:2639:18
    #3 0x4e2cec in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1670:28
    #4 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #5 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #6 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #7 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #8 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #9 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #10 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #11 0x7f3436eca2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #12 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

CC'ing third_party/fontconfig/OWNERS for initial triage.
Also +mmoroz@ in case this needs special labeling due to UBSAN issue.

Non-minimized repro (probably doesn't need use_libfuzzer and is probably unrelated to //media):

args.gn:
use_libfuzzer = true
is_debug = false
is_ubsan_security = true
optimize_for_fuzzing = true
#probabbly not required for repro:
enable_nacl = false
proprietary_codecs = true
ffmpeg_branding="ChromeOS"

gn gen <<<path to build output containing args.gn>>>
ninja -C <<<path-to-...> mediasource_WEBM_VP8_pipeline_integration_fuzzer

Comment 1 by mmoroz@chromium.org, Mar 21 2018

Labels: Stability-UndefinedBehaviorSanitizer

Comment 2 by spang@chromium.org, Mar 21 2018 

Are those really the only args? How are you getting use_bundled_fontconfig set ?

Comment 3 by wolenetz@chromium.org, Mar 22 2018 

Yes (% I use goma), on linux Trusty, with //src @ a8f1bf8df6644b1fc825f50cccd9986d5ae20e7a, and a freshly created out/libfuzzer with those args.gn, I'm now getting:


[...] ACTION //base/test:do_generate_fontconfig_caches(//build/toolchain/linux:clang_x64)
../../third_party/fontconfig/src/src/fcfreetype.c:2333:33: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
    #0 0x4e54ba in FcFreeTypeCharSetAndSpacingForSize third_party/fontconfig/src/src/fcfreetype.c:2333:33
    #1 0x4e352f in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1853:10
    #2 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #3 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #4 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #5 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #6 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #7 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #8 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #9 0x7f81146db2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #10 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

../../third_party/fontconfig/src/src/ftglue.c:233:28: runtime error: left shift of 245 by 24 places cannot be represented in type 'int'
    #0 0x4f9fd7 in ftglue_face_goto_table third_party/fontconfig/src/src/ftglue.c:233:28
    #1 0x4e6a0f in GetScriptTags third_party/fontconfig/src/src/fcfreetype.c:2557:19
    #2 0x4e44d0 in FcFontCapabilities third_party/fontconfig/src/src/fcfreetype.c:2639:18
    #3 0x4e2cec in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1670:28
    #4 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #5 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #6 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #7 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #8 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #9 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #10 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #11 0x7f81146db2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #12 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

../../third_party/fontconfig/src/src/fccharset.c:597:48: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
    #0 0x4dbe5b in FcCharSetHasChar third_party/fontconfig/src/src/fccharset.c:597:48
    #1 0x4e5658 in FcFreeTypeCharSetAndSpacingForSize third_party/fontconfig/src/src/fcfreetype.c:2354:11
    #2 0x4e352f in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1853:10
    #3 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #4 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #5 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #6 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #7 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #8 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #9 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #10 0x7f81146db2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #11 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

../../third_party/fontconfig/src/src/fccharset.c:277:14: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
    #0 0x4dacb8 in FcCharSetAddChar third_party/fontconfig/src/src/fccharset.c:277:14
    #1 0x4e566e in FcFreeTypeCharSetAndSpacingForSize third_party/fontconfig/src/src/fcfreetype.c:2355:4
    #2 0x4e352f in IA__FcFreeTypeQueryFace third_party/fontconfig/src/src/fcfreetype.c:1853:10
    #3 0x4e0a0d in FcFileScanFontConfig third_party/fontconfig/src/src/fcdir.c:102:9
    #4 0x4e1017 in FcDirScanConfig third_party/fontconfig/src/src/fcdir.c:305:2
    #5 0x4e11e2 in FcDirCacheScan third_party/fontconfig/src/src/fcdir.c:371:10
    #6 0x4d1a09 in FcConfigAddDirList third_party/fontconfig/src/src/fccfg.c:380:10
    #7 0x4d1873 in FcConfigBuildFonts third_party/fontconfig/src/src/fccfg.c:413:10
    #8 0x33ff0c in base::SetUpFontconfig() base/test/fontconfig_util_linux.cc:457:3
    #9 0x33f8d1 in main base/test/generate_fontconfig_caches.cc:13:3
    #10 0x7f81146db2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #11 0x325029 in _start (/ssd/trunk_blink_tot/src/out/libfuzzer/generate_fontconfig_caches+0x325029)

Comment 4 by wolenetz@chromium.org, Mar 22 2018 

Note, I use a high level of parallelism in ninja options with goma.

Comment 5 by wolenetz@chromium.org, Mar 22 2018 

w.r.t. use_bundled_fontconfig, I'm less certain. Maybe this: https://cs.chromium.org/chromium/src/third_party/fontconfig/fontconfig.gni?q=use_bundled_fontconfig&sq=package:chromium&dr=C&l=10

Probably better to look at the build ACTION in scope of which the errors occurred ( //base/test:do_generate_fontconfig_caches ).

Comment 6 by spang@chromium.org, Mar 22 2018 

Ah, that explains. I hadn't sen the change that switched linux over to the bundled one.
►

Sign in to add a comment