Summary
curveCurveIntersections() terminates the interpreter when given two quadratic curves containing only finite floats with extreme magnitudes.
Versions
fontTools 4.63.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39
Reproducer
from fontTools.misc.bezierTools import curveCurveIntersections
extent = 1e308
curveCurveIntersections(
((extent, -extent), (0.0, 0.0), (-extent, extent)),
((0.0, 0.0), (1.0, 1.0), (2.0, 0.0)),
)
Segmentation fault (core dumped)
ASan result
I built fontTools 4.63.0 from source with Clang 18 using -fsanitize=address,undefined -fno-omit-frame-pointer.
ASan reports a native stack overflow and shows the same generated Cython recursion frame repeated until the stack is exhausted:
ERROR: AddressSanitizer: stack-overflow
#16 _curve_curve_intersections_t Lib/fontTools/misc/bezierTools.c:25678
#19 _curve_curve_intersections_t Lib/fontTools/misc/bezierTools.c:26356
#22 _curve_curve_intersections_t Lib/fontTools/misc/bezierTools.c:26356
#25 _curve_curve_intersections_t Lib/fontTools/misc/bezierTools.c:26356
...
SUMMARY: AddressSanitizer: stack-overflow
I found this while fuzzing Python C extension modules.
I expected the function to raise a Python exception rather than terminate the process.
Summary
curveCurveIntersections()terminates the interpreter when given two quadratic curves containing only finite floats with extreme magnitudes.Versions
fontTools 4.63.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39
Reproducer
Segmentation fault (core dumped)ASan result
I built fontTools 4.63.0 from source with Clang 18 using
-fsanitize=address,undefined -fno-omit-frame-pointer.ASan reports a native stack overflow and shows the same generated Cython recursion frame repeated until the stack is exhausted:
I found this while fuzzing Python C extension modules.
I expected the function to raise a Python exception rather than terminate the process.