Skip to content

curveCurveIntersections() segfaults with extreme finite coordinates #4166

Description

@marinelay

Summary

curveCurveIntersections() terminates the interpreter when given two quadratic curves containing only finite floats with extreme magnitudes.

Versions

fontTools 4.63.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39

Reproducer

from fontTools.misc.bezierTools import curveCurveIntersections

extent = 1e308

curveCurveIntersections(
    ((extent, -extent), (0.0, 0.0), (-extent, extent)),
    ((0.0, 0.0), (1.0, 1.0), (2.0, 0.0)),
)
Segmentation fault (core dumped)

ASan result

I built fontTools 4.63.0 from source with Clang 18 using -fsanitize=address,undefined -fno-omit-frame-pointer.
ASan reports a native stack overflow and shows the same generated Cython recursion frame repeated until the stack is exhausted:

ERROR: AddressSanitizer: stack-overflow
    #16 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:25678
    #19 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    #22 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    #25 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    ...
SUMMARY: AddressSanitizer: stack-overflow

I found this while fuzzing Python C extension modules.
I expected the function to raise a Python exception rather than terminate the process.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions