<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div style="" class="default-style">
<div>
Dear all,
<br>
<br>I would like to report two potential bugs in TeX. Both bugs are part of how TeX reads TFM files:
</div>
<div>
<br>
</div>
<ol>
<li>When a TFM file has a design size of at least 1024pt, and it is loaded with a scaling factor of at least 32, TeX will calculate an incorrect size for the font without raising an error message.<br><br>This is how this bug can be reproduced:<br>
<ol>
<li>Create a TFM file with a design size of 1024 pt. This can for example be achieved by modifying one of the standard TFM files:<br>
<ul>
<li>$ tftopl cmr10.tfm > bug.pl</li>
<li>Change the design size to 1024 pt by substituting (DESIGNSIZE R 10.0) with (DESIGNSIZE R 1024.0) in bug.pl</li>
<li>$ pltotf bug.pl > bug.tfm</li>
</ul></li>
<li>In TeX, load the font with a scaling factor of 32:<br><br>This is TeX, Version 3.14159265 (TeX Live 2019/Debian) (preloaded format=tex)<br>**\font\a=bug scaled 32000<br><br>*\show\a<br>> \a=select font bug at 1000.0pt.<br><br>The expected size would by 32768.0pt.<br><br></li>
</ol>This bug is caused by an unchecked overflow in the call to xn_over_d in module 568 (ARITH_ERROR is not checked after the call).<br><br></li>
<li>A related bug is triggered when a TFM file with design size of at least 64pt is loaded with scaling factor such that the resulting size exceeds 2048pt but is less than 32768pt. This causes a multiplication overflow which causes TeX to crash.<br><br>This is how this bug can be reproduced:<br>
<ol>
<li>Create a TFM file with a design size of 256 pt. This can for example be achieved by modifying one of the standard TFM files:<br>
<ul>
<li>$ tftopl cmr10.tfm > bug.pl</li>
<li>Change the design size to 256 pt by substituting (DESIGNSIZE R 10.0) with (DESIGNSIZE R 256.0) in bug.pl</li>
<li>$ pltotf bug.pl > bug.tfm</li>
</ul></li>
<li>In TeX, load the font with a scaling factor of 8:<br><br>This is TeX, Version 3.14159265 (TeX Live 2019/Debian) (preloaded format=tex)<br>**\font\a=bug scaled 8000<br>Floating point exception (core dumped)</li>
</ol><br>I believe this bug is caused by an overflow in the last multiplication in module 572. The code there makes the assumption that z is less than 2^{27} (as also stated explicitly in module 271) which is not enforced.<br></li>
</ol>
<div>
I suppose both bugs could be avoided by making the assumption explicit that loading a font with scaling does not create a font size larger or equal to 2048pt and enforcing this when loading a TFM file.
<br>
<br>Kind regards,
<br>Tyge Tiessen
<br>
</div>
<div>
<br>
</div>
</div>
</body>
</html>