GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `curveCurveIntersections()` segfaults with extreme finite coordinates · Issue #4166 · fonttools/fonttools

curveCurveIntersections() segfaults with extreme finite coordinates #4166

New issue
Copy link
New issue
Copy link
Open
#4180
Open
curveCurveIntersections() segfaults with extreme finite coordinates#4166
#4180
Copy link

Description

@marinelay
marinelay
opened on Aug 30, 2026
Issue body actions

Summary

curveCurveIntersections() terminates the interpreter when given two quadratic curves containing only finite floats with extreme magnitudes.

Versions

fontTools 4.63.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39

Reproducer

from fontTools.misc.bezierTools import curveCurveIntersections

extent = 1e308

curveCurveIntersections(
    ((extent, -extent), (0.0, 0.0), (-extent, extent)),
    ((0.0, 0.0), (1.0, 1.0), (2.0, 0.0)),
)
Segmentation fault (core dumped)

ASan result

I built fontTools 4.63.0 from source with Clang 18 using -fsanitize=address,undefined -fno-omit-frame-pointer.
ASan reports a native stack overflow and shows the same generated Cython recursion frame repeated until the stack is exhausted:

ERROR: AddressSanitizer: stack-overflow
    #16 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:25678
    #19 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    #22 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    #25 _curve_curve_intersections_t  Lib/fontTools/misc/bezierTools.c:26356
    ...
SUMMARY: AddressSanitizer: stack-overflow

I found this while fuzzing Python C extension modules.
I expected the function to raise a Python exception rather than terminate the process.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.