Bug Hunting Session
Bug 81516 - PDF: export crash when Source Han Sans CJK (OTF) font applied
Summary: PDF: export crash when Source Han Sans CJK (OTF) font applied
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Printing and PDF export (show other bugs)
Version:
(earliest affected)
3.6.7.2 release
Hardware: All All
: medium major
Assignee: Not Assigned
URL:
Whiteboard: target:4.4.0 target:4.3.1 target:4.2.7
Keywords: haveBacktrace, patch
: 81544 81586 81955 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-07-19 03:55 UTC by Kevin Suo
Modified: 2017-05-09 10:19 UTC (History)
11 users (show)

See Also:
Crash report or crash signature:


Attachments
linux backtrace (31.61 KB, text/x-log)
2014-07-19 03:58 UTC, Yousuf Philips (jay) (retired)
Details
the sample file i used (8.78 KB, application/vnd.oasis.opendocument.text)
2014-07-19 04:00 UTC, Yousuf Philips (jay) (retired)
Details
bt console from master sources (+ gdb session) (12.67 KB, text/plain)
2014-07-19 18:18 UTC, Julien Nabet
Details
Patch to cff.cxx (383 bytes, patch)
2014-08-03 15:30 UTC, Audrey Tang
Details
Impress file used to verify the patch independently from Writer (1.23 MB, application/vnd.oasis.opendocument.presentation)
2014-08-03 15:32 UTC, Audrey Tang
Details
successfully exported PDF, 4.3.1 2014-08-06 (228.22 KB, application/pdf)
2014-08-07 14:06 UTC, Kevin Suo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin Suo 2014-07-19 03:55:34 UTC
It is in the news that Adobe and Google release a full set of free and opensource CJK fonts: Source Han Sans (or "Noto Sans"). 

I found this set of fonts are very good for screen display and also for printing, so I was trying to export a pdf and share with others how this font look like.

However, libreoffice crashes everytime when exporting to PDF.

Steps to reproduce:

1. Download and install the font:
http://sourceforge.net/adobe/source-han-sans/wiki/Home/
(I downloaded the file "SourceHanSansCN-1.000.zip". You may also reproduce if you download other fonts, JP, KR,...)

2. New Writer file, type in any text, and apply the above font from font dropdown list.
(The font names for me is "思源黑体 CN Light/Bold/Normal/Regular..." in Chinese. On your system it may be "Source Han Sans CN Light/bold/...")

3. Export to PDF.
--> Crashes.

OS: Ubuntu 14.04 x86.
Can reproduce in versions 3.6.7.2, 4.3.0.3, and 4.3.1.0.0+ Time: 2014-07-18_15:46:12
Comment 1 Yousuf Philips (jay) (retired) 2014-07-19 03:58:12 UTC
Confirmed in Linux Mint and Windows in 4.3.1.
Comment 2 Yousuf Philips (jay) (retired) 2014-07-19 03:58:34 UTC
Created attachment 103073 [details]
linux backtrace
Comment 3 Yousuf Philips (jay) (retired) 2014-07-19 04:00:23 UTC
Created attachment 103074 [details]
the sample file i used
Comment 4 Cheng-Wei Chien 2014-07-19 13:38:34 UTC
Confirmed in Linux Ubuntu in 4.2.4 and 4.2.5
Comment 5 Julien Nabet 2014-07-19 18:18:53 UTC
Created attachment 103122 [details]
bt console from master sources (+ gdb session)

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I attached bt + gdb session.
Comment 6 Julien Nabet 2014-07-19 18:19:58 UTC
Caolan: I thought this one might interest you (bt attached + gdb session showing a problem in vcl/source/fontsubset/cff.cxx)
Comment 7 James Cloos 2014-07-19 21:01:49 UTC
Does the crash occur with the OTC or the OTF versions of the fonts
installed?

Ie, a single file per weight or several per?

It is possible that something doesn't yet support OTC-style fonts.
Comment 8 Julien Nabet 2014-07-19 21:37:25 UTC
(In reply to comment #7)
> Does the crash occur with the OTC or the OTF versions of the fonts
> installed?
I downloaded the zip file indicated in description, this one contained only otf files:
SourceHanSansCN-Bold.otf
SourceHanSansCN-ExtraLight.otf
SourceHanSansCN-Heavy.otf
SourceHanSansCN-Light.otf
SourceHanSansCN-Medium.otf
SourceHanSansCN-Normal.otf
SourceHanSansCN-Regular.otf
Comment 9 Julien Nabet 2014-07-20 04:19:16 UTC
*** Bug 81544 has been marked as a duplicate of this bug. ***
Comment 10 James Cloos 2014-07-20 05:38:11 UTC
Sorry.

I was following only via email; I didn’t have the initial post at hand when I replied.

I only have the OTC version loaded.

With version:

   LibreOffice 4.2.1.1 420m0(Build:1)

it fails to scale the non-latin glyphs to the same size as the latin glyphs when specifying Source Han Sans SC Medium.

These fonts have about as many glyphs as an SFNT can have.  Perhaps the FontSubsetInfo::CreateFontSubsetFromCff() code doesn’t support fonts with so many glyphs?
Comment 11 Julien Nabet 2014-07-21 07:23:06 UTC
*** Bug 81586 has been marked as a duplicate of this bug. ***
Comment 12 Satoru Matsumoto 2014-08-02 02:42:15 UTC
*** Bug 81955 has been marked as a duplicate of this bug. ***
Comment 13 Audrey Tang 2014-08-02 18:58:38 UTC
From the stack trace at https://bugs.freedesktop.org/attachment.cgi?id=103122 it looks like assert from http://docs.libreoffice.org/vcl/html/cff_8cxx_source.html#l01504 because maCffLocal is declared to 16 at http://docs.libreoffice.org/vcl/html/cff_8cxx_source.html#l00363 but mnFDAryCount requires more than 16 local CFFs.

Would extending 16 to 256 (or make it dynamically allocated) alleviate the problem?
Comment 14 Audrey Tang 2014-08-03 15:30:34 UTC
Created attachment 103925 [details]
Patch to cff.cxx

Confirmed this patch using the sample file in attachment 103074 [details], as well as a simple .odp file (attached separately, CC BY 4.0 @jimyhuang):

./instdir/program/soffice --headless --convert-to pdf test.odp
Comment 15 Audrey Tang 2014-08-03 15:32:09 UTC
Created attachment 103926 [details]
Impress file used to verify the patch independently from Writer
Comment 16 Audrey Tang 2014-08-04 14:12:54 UTC
It turns out the 16->256 FDArray count limit increase is correct (as in my patch), because per spec the max allowed FDArray count is 256.

More info from @kenlunde, main coordinator of Source Han Sans CJK:

Source Han Sans (and thus Noto Sans CJK) include 19 FDArray elements. The maximum number of FDArray elements is 256. For testing fodder, please grab one or most fonts that are provided in the following CJK Type Blog article that @kenlunde published over two years ago: http://blogs.adobe.com/CCJKType/2012/05/all-unicode-cfr.html

Source: https://github.com/adobe-fonts/source-han-sans/issues/27#issuecomment-51055950
Comment 17 Julien Nabet 2014-08-04 14:23:01 UTC
Audrey: thank you for your very interesting information (I include the proposed patch)! :-)

Since some devs might be in vacation, would it be possible you send a message on dev mailing list? (see http://nabble.documentfoundation.org/Dev-f1639786.html)
Comment 18 Audrey Tang 2014-08-04 14:48:58 UTC
Julien, thanks for the prompting! It's posted as http://nabble.documentfoundation.org/PATCH-Bug-81516-PDF-export-crash-when-Source-Han-Sans-CJK-td4117712.html and pending moderator approval.
Comment 19 Michael Stahl (CIB) 2014-08-04 19:33:35 UTC
hi Audrey,

the patch is looking good and should fix the crash for this particular font.

but it raises the question: why does this actually crash, and not
just fail to read the font?  clearly crashing when reading
potentially untrusted input is a bad idea...

i'd suggest to turn the assert from
http://docs.libreoffice.org/vcl/html/cff_8cxx_source.html#l01504
into a real check and to cap the mnFDAryCount to the array size.

also, can you please send a license mail to
 libreoffice@lists.freedesktop.org
as described on this page:

https://wiki.documentfoundation.org/Development/Developers#Example_Statement

feel free to add an entry for yourself on the page too.
Comment 20 Audrey Tang 2014-08-05 02:13:32 UTC
Re assert(), I'd like to defer it to devs more versed in the error handling paradigm; IMHO it's unlikely that a font containing >256 FDArray will get used to the PDF export stage, as it probably won't render in the first place.

Re license. I've just edited the Wiki and sent this CC0 Universal Decalaration:

To the extent possible under law, I waive all copyright and related or neighboring rights to my past & future contributions to LibreOffice.

http://creativecommons.org/publicdomain/zero/1.0

Cheers,
Audrey
Comment 21 Commit Notification 2014-08-05 07:58:53 UTC
Audrey Tang committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3b38a2342e48a2aec3c2e4f5aebf883db4b84101

fdo#81516 Support fonts like Source Han Sans with > 16 FDArray elements



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 22 Stephan Bergmann 2014-08-05 08:13:28 UTC
(In reply to comment #21)
> Audrey Tang committed a patch related to this issue.
> It has been pushed to "master":
> 
> http://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=3b38a2342e48a2aec3c2e4f5aebf883db4b84101
> 
> fdo#81516 Support fonts like Source Han Sans with > 16 FDArray elements

Committed attachment 103925 [details] now without noticing comment 19.  Anyway, the change as-is should be especially good enough as a hotfix for older versions, so requested backports now to libreoffice-4-2 towards LO 4.2.7 (<https://gerrit.libreoffice.org/#/c/10746/>) and to libreoffice-4-3 towards LO 4.3.1 (<https://gerrit.libreoffice.org/#/c/10745/>).  Please continue on master with any improvements as discussed in comment 19.
Comment 23 Commit Notification 2014-08-05 08:29:50 UTC
Audrey Tang committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=bff075cbe1b969361a891d43ae24a648aa429373&h=libreoffice-4-3

fdo#81516 Support fonts like Source Han Sans with > 16 FDArray elements


It will be available in LibreOffice 4.3.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 24 Commit Notification 2014-08-05 08:31:51 UTC
Audrey Tang committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c1a53308423ebf45c7209ca1359b205b6f0ac236&h=libreoffice-4-2

fdo#81516 Support fonts like Source Han Sans with > 16 FDArray elements


It will be available in LibreOffice 4.2.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 25 Julien Nabet 2014-08-05 09:32:04 UTC
Thanks to Audrey and Stephan, let's put this one to FIXED.
Comment 26 Commit Notification 2014-08-05 11:29:42 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=45b0b47d114437198c9e0872d427576e6e7e6cc6

fdo#81516: vcl: limit number of CFFs read from font



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 27 Commit Notification 2014-08-06 08:06:37 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=51acd019a038e0b69490290d4808ec49c7c27ba7&h=libreoffice-4-3

fdo#81516: vcl: limit number of CFFs read from font


It will be available in LibreOffice 4.3.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 28 Commit Notification 2014-08-07 08:44:26 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5591c9c2ab77d32a923200f980e8fe7af61ffd5b&h=libreoffice-4-2

fdo#81516: vcl: limit number of CFFs read from font


It will be available in LibreOffice 4.2.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 29 Kevin Suo 2014-08-07 14:05:00 UTC
Verified FIXED in
Version: 4.3.1.0.0+
Build ID: 51acd019a038e0b69490290d4808ec49c7c27ba7
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:libreoffice-4-3, Time: 2014-08-06_08:05:04

Thanks for the hard work!
Comment 30 Kevin Suo 2014-08-07 14:06:49 UTC
Created attachment 104228 [details]
successfully exported PDF, 4.3.1 2014-08-06

PDF exported successfully, and the fonts embedded successfully.
Comment 31 Kevin Suo 2014-08-07 14:14:30 UTC
Before the fix, Source Han Sans will also fail to be embedded in ODT file. Now it's successful.
Comment 32 Yousuf Philips (jay) (retired) 2014-08-12 07:51:58 UTC
I think it might be a good idea to verify if the OTCs is fine on OS X and the multilingual OTFs are fine on Windows and OS X, as shown in the flowchart < http://sourceforge.net/adobe/source-han-sans/wiki/Home/attachment/shs-flowchart.png >