| Summary: |
Array index out of bound crash in cairo_cff_font_subset_charstrings_and_subroutines when using the PDF backend |
| Product: |
cairo
|
Reporter: |
Jonas Ådahl <jadahl> |
| Component: |
pdf backend | Assignee: |
Adrian Johnson <ajohnson> |
| Status: |
RESOLVED
DUPLICATE
|
QA Contact: |
cairo-bugs mailing list <cairo-bugs> |
| Severity: |
major
|
|
|
| Priority: |
medium
|
|
|
| Version: |
unspecified | |
|
| Hardware: |
Other | |
|
| OS: |
All | |
|
| Whiteboard: |
|
|
i915 platform:
|
|
i915 features:
|
|
|---|
| Attachments: |
Backtrace
|
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
Created attachment 119421 [details] Backtrace Cairo version: 1.14.4. I tried to print a web page as a PDF but doing so just resulted in the web browser / browser tab process crashing. Didn't matter whether I used Epiphany or Firefox, they both crashed in the same place in cairo. The page printed contained lots of chinese characters which I suspect might be the reason. I'm attaching a full stack trace I caught when testing in Epiphany. I cut it off at the uninteresting WebKit message loop parts. The crash (or assert if those are enabled) seems to happen because the 'glyph' index is far larger than the length of the array: 1791 element = _cairo_array_index (&font->charstrings_index, glyph); (gdb) print glyph $2 = 45472 (gdb) print font->charstrings_index $3 = {size = 32768, num_elements = 30907, element_size = 24, elements = 0x560839b3abe0 ""} I cannot attach the content that reproduces the crash because the document is a national park entry permission paper with personal information, but I have a HTML file with sensitive information I could find stripped out I could provide privately to a developer wanting to look at a reproduction case.