x/image/font/plan9font: slice bounds out of range #56931
Description
What version of Go are you using (go version)?
$ go version go version go1.19 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env GO111MODULE="" GOARCH="amd64" GOBIN="" GOCACHE="/root/.cache/go-build" GOENV="/root/.config/go/env" GOEXE="" GOEXPERIMENT="" GOFLAGS="" GOHOSTARCH="amd64" GOHOSTOS="linux" GOINSECURE="" GOMODCACHE="/root/go/pkg/mod" GONOPROXY="" GONOSUMDB="" GOOS="linux" GOPATH="/root/go" GOPRIVATE="" GOPROXY="https://proxy.golang.org,direct" GOROOT="/root/.go" GOSUMDB="sum.golang.org" GOTMPDIR="" GOTOOLDIR="/root/.go/pkg/tool/linux_amd64" GOVCS="" GOVERSION="go1.19" GCCGO="gccgo" GOAMD64="v1" AR="ar" CC="clang" CXX="clang++" CGO_ENABLED="1" GOMOD="/src/ngolo-fuzzing/go.mod" GOWORK="" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config" GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2481516251=/tmp/go-build -gno-record-gcc-switches"
What did you do?
Run https://go.dev/play/p/79a_SlnK9GT?v=gotip
What did you expect to see?
The program finishing and printing Hello
What did you see instead?
panic: runtime error: slice bounds out of range [:-3560154814085769899]
goroutine 1 [running]:
golang.org/x/image/font/plan9font.parseImage({0xc000074eb7, 0xa9, 0xa9})
/tmp/gopath4079062285/pkg/mod/golang.org/x/[email protected]/font/plan9font/plan9font.go:482 +0x7f8
golang.org/x/image/font/plan9font.ParseSubfont({0xc000074eb7?, 0x1?, 0x405b8a?}, 0x0)
/tmp/gopath4079062285/pkg/mod/golang.org/x/[email protected]/font/plan9font/plan9font.go:322 +0x3a
main.main()
/tmp/sandbox1860579726/prog.go:12 +0x150
Program exited.
Found by https://github.com/catenacyber/ngolo-fuzzing with oss-fuzz :
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53718