[cairo-bugs] [Bug 92829] New: Array index out of bound crash in cairo_cff_font_subset_charstrings_and_subroutines when using the PDF backend

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=92829

            Bug ID: 92829
           Summary: Array index out of bound crash in
                    cairo_cff_font_subset_charstrings_and_subroutines when
                    using the PDF backend
           Product: cairo
           Version: unspecified
          Hardware: Other
                OS: All
            Status: NEW
          Severity: major
          Priority: medium
         Component: pdf backend
          Assignee: ajohnson at redneon.com
          Reporter: jadahl at gmail.com
        QA Contact: cairo-bugs at cairographics.org

Created attachment 119421
  --> https://bugs.freedesktop.org/attachment.cgi?id=119421&action=edit
Backtrace

Cairo version: 1.14.4.

I tried to print a web page as a PDF but doing so just resulted in the web
browser / browser tab process crashing. Didn't matter whether I used Epiphany
or Firefox, they both crashed in the same place in cairo.

The page printed contained lots of chinese characters which I suspect might be
the reason. I'm attaching a full stack trace I caught when testing in Epiphany.
I cut it off at the uninteresting WebKit message loop parts.

The crash (or assert if those are enabled) seems to happen because the 'glyph'
index is far larger than the length of the array:

1791            element = _cairo_array_index (&font->charstrings_index, glyph);
(gdb) print glyph
$2 = 45472
(gdb) print font->charstrings_index 
$3 = {size = 32768, num_elements = 30907, element_size = 24, 
  elements = 0x560839b3abe0 ""}


I cannot attach the content that reproduces the crash because the document is a
national park entry permission paper with personal information, but I have a
HTML file with sensitive information I could find stripped out I could provide
privately to a developer wanting to look at a reproduction case.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo-bugs/attachments/20151105/c3d1f8cd/attachment.html>