{"action":"created","issue":{"url":"https://api.github.com/repos/behdad/harfbuzz/issues/161","labels_url":"https://api.github.com/repos/behdad/harfbuzz/issues/161/labels{/name}","comments_url":"https://api.github.com/repos/behdad/harfbuzz/issues/161/comments","events_url":"https://api.github.com/repos/behdad/harfbuzz/issues/161/events","html_url":"https://github.com/behdad/harfbuzz/issues/161","id":115377300,"number":161,"title":"1.5K input consumes 8Gb of RAM","user":{"login":"kcc","id":1789297,"avatar_url":"https://avatars.githubusercontent.com/u/1789297?v=3","gravatar_id":"","url":"https://api.github.com/users/kcc","html_url":"https://github.com/kcc","followers_url":"https://api.github.com/users/kcc/followers","following_url":"https://api.github.com/users/kcc/following{/other_user}","gists_url":"https://api.github.com/users/kcc/gists{/gist_id}","starred_url":"https://api.github.com/users/kcc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcc/subscriptions","organizations_url":"https://api.github.com/users/kcc/orgs","repos_url":"https://api.github.com/users/kcc/repos","events_url":"https://api.github.com/users/kcc/events{/privacy}","received_events_url":"https://api.github.com/users/kcc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-05T21:20:58Z","updated_at":"2015-11-06T21:51:37Z","closed_at":"2015-11-06T07:56:00Z","body":"found by libFuzzer, see #139 \r\n\r\nFeed the attached input to the fuzzer target function, observe it consume 8Gb RAM. \r\n[crash-3511ff5c1647150595846ac414c595cccac34f18.pdf](https://github.com/behdad/harfbuzz/files/28437/crash-3511ff5c1647150595846ac414c595cccac34f18.pdf)\r\n\r\n\r\nHuge allocations seem to be coming from here: \r\n```\r\n    #10 0x4e9a07 in hb_buffer_t::enlarge(unsigned int) src/hb-buffer.cc:110:37\r\n    #11 0x4ed70a in hb_buffer_t::ensure(unsigned int) src/./hb-buffer-private.hh:206:56\r\n    #12 0x4ed70a in hb_buffer_t::make_room_for(unsigned int, unsigned int) src/hb-buffer.cc:134\r\n    #13 0x4ed70a in hb_buffer_t::output_glyph(unsigned int) src/hb-buffer.cc:342\r\n    #14 0x653ba4 in OT::Sequence::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsub-table.hh:291:7\r\n    #15 0x6524c8 in OT::MultipleSubstFormat1::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsub-table.hh:360:5\r\n    #16 0x6524c8 in bool OT::hb_apply_context_t::dispatch<OT::MultipleSubstFormat1>(OT::MultipleSubstFormat1 const&) src/./hb-ot-layout-gsubgpos-private.hh:446\r\n    #17 0x6524c8 in OT::hb_apply_context_t::return_t OT::MultipleSubst::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsub-table.hh:423\r\n    #18 0x6524c8 in OT::hb_apply_context_t::return_t OT::SubstLookupSubTable::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*, unsigned int) const src/./hb-ot-layout-gsub-table.hh:1080\r\n    #19 0x5ecc79 in OT::hb_apply_context_t::return_t OT::Lookup::dispatch<OT::SubstLookupSubTable, OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-common-private.hh:625:»\r\n    #20 0x5ecc79 in OT::hb_apply_context_t::return_t OT::SubstLookup::dispatch<OT::hb_apply_context_t>(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsub-table.hh:1234\r\n    #21 0x5ecc79 in OT::SubstLookup::apply(OT::hb_apply_context_t*) const src/./hb-ot-layout-gsub-table.hh:1127\r\n    #22 0x5ecc79 in _ZL13apply_forwardIN2OT11SubstLookupEEbPNS0_18hb_apply_context_tERKT_RK33hb_ot_layout_lookup_accelerator_t src/hb-ot-layout.cc:898\r\n    #23 0x5ecc79 in _ZL12apply_stringI9GSUBProxyEvPN2OT18hb_apply_context_tERKNT_6LookupERK33hb_ot_layout_lookup_accelerator_t src/hb-ot-layout.cc:976\r\n    #24 0x5fcb93 in void hb_ot_map_t::apply<GSUBProxy>(GSUBProxy const&, hb_ot_shape_plan_t const*, hb_font_t*, hb_buffer_t*) const src/hb-ot-layout.cc:1027:7\r\n    #25 0x5ebe43 in hb_ot_map_t::substitute(hb_ot_shape_plan_t const*, hb_font_t*, hb_buffer_t*) const src/hb-ot-layout.cc:1043:3\r\n    #26 0x53f13d in hb_ot_shape_plan_t::substitute(hb_font_t*, hb_buffer_t*) const src/./hb-ot-shape-private.hh:59:73\r\n    #27 0x53f13d in hb_ot_substitute_complex(hb_ot_shape_context_t*) src/hb-ot-shape.cc:588\r\n    #28 0x53f13d in hb_ot_substitute(hb_ot_shape_context_t*) src/hb-ot-shape.cc:602\r\n    #29 0x53f13d in hb_ot_shape_internal(hb_ot_shape_context_t*) src/hb-ot-shape.cc:818\r\n    #30 0x53f13d in _hb_ot_shape src/hb-ot-shape.cc:839\r\n    #31 0x522686 in hb_shape_plan_execute src/./hb-shaper-list.hh:43:1\r\n    #32 0x51f986 in hb_shape_full src/hb-shape.cc:375:19\r\n    #33 0x51f986 in hb_shape src/hb-shape.cc:405\r\n```"},"comment":{"url":"https://api.github.com/repos/behdad/harfbuzz/issues/comments/154552704","html_url":"https://github.com/behdad/harfbuzz/issues/161#issuecomment-154552704","issue_url":"https://api.github.com/repos/behdad/harfbuzz/issues/161","id":154552704,"user":{"login":"kcc","id":1789297,"avatar_url":"https://avatars.githubusercontent.com/u/1789297?v=3","gravatar_id":"","url":"https://api.github.com/users/kcc","html_url":"https://github.com/kcc","followers_url":"https://api.github.com/users/kcc/followers","following_url":"https://api.github.com/users/kcc/following{/other_user}","gists_url":"https://api.github.com/users/kcc/gists{/gist_id}","starred_url":"https://api.github.com/users/kcc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcc/subscriptions","organizations_url":"https://api.github.com/users/kcc/orgs","repos_url":"https://api.github.com/users/kcc/repos","events_url":"https://api.github.com/users/kcc/events{/privacy}","received_events_url":"https://api.github.com/users/kcc/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T21:51:37Z","updated_at":"2015-11-06T21:51:37Z","body":"Now the fuzzer crashes like this (see https://github.com/behdad/harfbuzz/issues/157#issuecomment-154525864):\r\n```\r\nharfbuzz_asan_cov_fuzzer: hb-buffer.cc:398: bool hb_buffer_t::move_to(unsigned int): Assertion `i <= out_len + (len - idx)' failed.\r\n```"}}