{"action":"created","issue":{"url":"https://api.github.com/repos/behdad/harfbuzz/issues/157","labels_url":"https://api.github.com/repos/behdad/harfbuzz/issues/157/labels{/name}","comments_url":"https://api.github.com/repos/behdad/harfbuzz/issues/157/comments","events_url":"https://api.github.com/repos/behdad/harfbuzz/issues/157/events","html_url":"https://github.com/behdad/harfbuzz/issues/157","id":114884076,"number":157,"title":"timeout in context_apply_lookup","user":{"login":"kcc","id":1789297,"avatar_url":"https://avatars.githubusercontent.com/u/1789297?v=3","gravatar_id":"","url":"https://api.github.com/users/kcc","html_url":"https://github.com/kcc","followers_url":"https://api.github.com/users/kcc/followers","following_url":"https://api.github.com/users/kcc/following{/other_user}","gists_url":"https://api.github.com/users/kcc/gists{/gist_id}","starred_url":"https://api.github.com/users/kcc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcc/subscriptions","organizations_url":"https://api.github.com/users/kcc/orgs","repos_url":"https://api.github.com/users/kcc/repos","events_url":"https://api.github.com/users/kcc/events{/privacy}","received_events_url":"https://api.github.com/users/kcc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-11-03T18:51:10Z","updated_at":"2015-11-12T11:00:31Z","closed_at":null,"body":"\r\n[timeout-c7f0b03f12f51efc0702eb48d336e7d4e1d3d252.pdf](https://github.com/behdad/harfbuzz/files/26400/timeout-c7f0b03f12f51efc0702eb48d336e7d4e1d3d252.pdf)\r\nFound with libFuzzer. \r\nRun the attached file through the fuzzer target (see #139), it will run at least half hour (maybe forever)\r\nThis bug may cause DOS attacks and such, but it also hurts further fuzzing immensely. \r\n\r\nThe stack trace:\r\n\r\n```\r\n    #5 0x5c8e45 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:969:3\r\n    #6 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #7 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #8 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #9 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #10 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #11 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #12 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #13 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #14 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #15 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #16 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #17 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #18 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #19 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #20 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #21 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #22 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #23 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #24 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #25 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #26 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #27 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #28 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #29 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #30 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #31 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #32 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #33 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #34 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #35 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #36 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #37 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #38 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #39 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #40 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #41 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #42 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #43 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #44 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #45 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #46 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #47 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #48 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #49 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #50 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #51 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #52 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #53 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #54 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #55 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #56 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #57 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #58 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #59 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #60 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #61 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #62 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #63 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #64 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #65 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #66 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #67 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #68 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #69 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #70 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #71 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #72 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #73 0x62c7cb in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #74 0x62c7cb in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #75 0x62c7cb in OT::PosLookup::apply_recurse_func(OT::hb_apply_context_t*, unsigned int) src/./hb-ot-layout-gpos-table.hh:1629\r\n    #76 0x5c7ce8 in OT::hb_apply_context_t::recurse(unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:455:16\r\n    #77 0x5c7ce8 in OT::apply_lookup(OT::hb_apply_context_t*, unsigned int, unsigned int*, unsigned int, OT::LookupRecord const*, unsigned int) src/./hb-ot-layout-gsubgpos-private.hh:978\r\n    #78 0x625c63 in OT::context_apply_lookup(OT::hb_apply_context_t*, unsigned int, OT::IntType<unsigned short, 2u> const*, unsigned int, OT::LookupRecord const*, OT::ContextApplyLookupContext&) src/./hb-ot-layout-gsubgpos-private.hh:1102:10\r\n    #79 0x625c63 in OT::Rule::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1141\r\n    #80 0x625c63 in OT::RuleSet::apply(OT::hb_apply_context_t*, OT::ContextApplyLookupContext&) const src/./hb-ot-layout-gsubgpos-private.hh:1204\r\n    #81 0x6204ca in OT::ContextFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1290:5\r\n    #82 0x6204ca in bool OT::hb_apply_context_t::dispatch<OT::ContextFormat1>(OT::ContextFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #83 0x6204ca in OT::hb_apply_context_t::return_t OT::Context::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsubgpos-private.hh:1510\r\n    #84 0x62d7d3 in OT::hb_apply_context_t::return_t OT::PosLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gpos-table.hh:1417:20\r\n    #85 0x5d22f5 in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::PosLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:620:40\r\n    #86 0x5d22f5 in OT::hb_apply_context_t::return_t OT::PosLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1478\r\n    #87 0x5d22f5 in OT::PosLookup::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gpos-table.hh:1455\r\n    #88 0x5d22f5 in _ZL13apply_forwardIN2OT9PosLookupEEbPNS0_18hb_apply_context_tERKT_RK33hb_ot_layout_lookup_accelerator_t src/hb-ot-layout.cc:898\r\n    #89 0x5d22f5 in _ZL12apply_stringI9GPOSProxyEvPN2OT18hb_apply_context_tERKNT_6LookupERK33hb_ot_layout_lookup_accelerator_t src/hb-ot-layout.cc:976\r\n    #90 0x5d22f5 in void hb_ot_map_t::apply<GPOSProxy>(GPOSProxy const&, hb_ot_shape_plan_t const*, hb_font_t*, hb_buffer_t*) const src/hb-ot-layout.cc:1027\r\n    #91 0x5c07cd in hb_ot_map_t::position(hb_ot_shape_plan_t const*, hb_font_t*, hb_buffer_t*) const src/hb-ot-layout.cc:1049:3\r\n    #92 0x5264d1 in hb_ot_shape_plan_t::position(hb_font_t*, hb_buffer_t*) const src/./hb-ot-shape-private.hh:60:71\r\n    #93 0x5264d1 in hb_ot_position_complex(hb_ot_shape_context_t*) src/hb-ot-shape.cc:715\r\n    #94 0x5264d1 in hb_ot_position(hb_ot_shape_context_t*) src/hb-ot-shape.cc:754\r\n    #95 0x5264d1 in hb_ot_shape_internal(hb_ot_shape_context_t*) src/hb-ot-shape.cc:796\r\n    #96 0x5264d1 in _hb_ot_shape src/hb-ot-shape.cc:816\r\n    #97 0x50bb8c in hb_shape_plan_execute src/./hb-shaper-list.hh:43:1\r\n    #98 0x509570 in hb_shape_full src/hb-shape.cc:375:19\r\n    #99 0x509570 in hb_shape src/hb-shape.cc:405\r\n    #100 0x4d6936 in LLVMFuzzerTestOneInput \r\n```"},"comment":{"url":"https://api.github.com/repos/behdad/harfbuzz/issues/comments/156073134","html_url":"https://github.com/behdad/harfbuzz/issues/157#issuecomment-156073134","issue_url":"https://api.github.com/repos/behdad/harfbuzz/issues/157","id":156073134,"user":{"login":"behdad","id":142891,"avatar_url":"https://avatars.githubusercontent.com/u/142891?v=3","gravatar_id":"","url":"https://api.github.com/users/behdad","html_url":"https://github.com/behdad","followers_url":"https://api.github.com/users/behdad/followers","following_url":"https://api.github.com/users/behdad/following{/other_user}","gists_url":"https://api.github.com/users/behdad/gists{/gist_id}","starred_url":"https://api.github.com/users/behdad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/behdad/subscriptions","organizations_url":"https://api.github.com/users/behdad/orgs","repos_url":"https://api.github.com/users/behdad/repos","events_url":"https://api.github.com/users/behdad/events{/privacy}","received_events_url":"https://api.github.com/users/behdad/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T11:00:31Z","updated_at":"2015-11-12T11:00:31Z","body":"> I've started using\r\n> -DHB_MAX_NESTING_LEVEL=3 -DHB_BUFFER_MAX_EXPANSION_FACTOR=3 -DHB_BUFFER_MAX_LEN_MIN=8\r\n> and now I see this:\r\n\r\nCan I get test for this please?"}}