Bugzilla – Bug 1173396
fonttosfnt writes nondeterministic .otb files from ASLR
Last modified: 2020-06-26 10:33:05 UTC
While working on reproducible builds for openSUSE, I found that when building the xorg-x11-fonts-converted package, there were slight differences between each build Steps to Reproduce: fonttosfnt -b -c -g 2 -m 2 -o Adobe-Courier-Bold-Oblique.otb /usr/share/fonts/75dpi/courBO08-ISO8859-1.pcf.gz ; md5sum Adobe-Courier-Bold-Oblique.otb filterdiff 'hexdump -C' {a,b}.otb 00000040 e3 43 7d a3 00 00 0a f0 00 00 00 36 63 6d 61 70 |.C}........6cmap| 00000050 00 ee 01 48 00 00 0b 28 00 00 00 3c 67 6c 79 66 |...H...(...<glyf| 00000060 00 00 00 00 00 00 0b 64 00 00 00 00 68 65 61 64 |.......d....head| -00000070 6f 36 b6 de 00 00 0b 64 00 00 00 36 68 68 65 61 |o6.....d...6hhea| +00000070 bc 09 6f 3e 00 00 0b 64 00 00 00 36 68 68 65 61 |..o>...d...6hhea| 00000080 10 69 05 40 00 00 0b 9c 00 00 00 24 68 6d 74 78 |.i.@.......$hmtx| 00000090 1c a0 fe 21 00 00 0b c0 00 00 03 00 6c 6f 63 61 |...!........loca| 000000a0 00 00 00 00 00 00 0e c0 00 00 01 82 6d 61 78 70 |............maxp| @@ -180,9 +180,9 @@ 00000b30 00 00 00 0c 00 04 00 30 00 00 00 08 00 04 00 02 |.......0........| 00000b40 00 04 00 00 00 7e 00 ff ff ff 00 00 00 00 00 20 |.....~......... | 00000b50 00 a0 ff ff 00 00 ff e1 ff c0 00 01 00 00 00 00 |................| -00000b60 00 00 00 00 00 01 00 00 00 01 00 00 bd 55 7b 6c |.............U{l| -00000b70 5f 0f 3c f5 00 01 08 00 00 00 0b 64 04 d1 29 50 |_.<........d..)P| -00000b80 00 00 0b 64 04 d1 29 50 ff 00 ff 00 07 80 09 80 |...d..)P........| +00000b60 00 00 00 00 00 01 00 00 00 01 00 00 70 82 c3 0c |............p...| +00000b70 5f 0f 3c f5 00 01 08 00 00 00 0b 64 ab 3a 85 80 |_.<........d.:..| +00000b80 00 00 0b 64 ab 3a 85 80 ff 00 ff 00 07 80 09 80 |...d.:..........| 00000b90 00 01 00 01 00 00 00 00 00 00 00 00 00 01 00 00 |................| 00000ba0 09 80 ff 00 00 66 06 80 ff 00 ff 00 07 80 00 01 |.....f..........| The first chunk is just the checksum-adjustment caused by diffs in the 2nd chunk. I already tried to add a memset after all malloc and calloc calls, but that did not make a difference. https://github.com/bmwiedemann/theunreproduciblepackage/tree/master/aslr has examples of how ASLR influenced outputs in the past. Running fonttosfnt under setarch -R to disable ASLR does make the output reproducible: for i in $(seq 1 5) ; do setarch -R fonttosfnt -b -c -g 2 -m 2 -o Adobe-Courier-Bold-Oblique.otb \ /usr/share/fonts/75dpi/courBO08-ISO8859-1.pcf.gz ; md5sum Adobe-Courier-Bold-Oblique.otb ; done | sort | uniq -c 5 b320eb3a6f93fe19be575ad536fcba3e Adobe-Courier-Bold-Oblique.otb