bugThe FreeType Project - Bugs: bug #30083, SIGSEGV while loading a glyph...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30083: SIGSEGV while loading a glyph (index 49)

Submitter:  Robert Swiecki <jagger>
Submitted:  Tue 08 Jun 2010 03:21:35 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.3.13

Fri 11 Jun 2010 06:14:36 AM UTC, comment #4: 

Thanks for testing.

 Werner LEMBERG <wl>
Group administrator
Thu 10 Jun 2010 05:49:15 PM UTC, comment #3: 

Yup, it was fixed in http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d3d2cc4fef72c6be9c454b3809c387e12b44cfc

It was buffer overflow in cff_decoder_parse_charstrings but now it's gone

(gdb) watch *0x7fffffffba10 == 0x00060000
Hardware watchpoint 1: *0x7fffffffba10 == 0x00060000
(gdb) r -m ABCDEFGHIJKLMNOPQRSTUVXYZ0123456789 20 sigsegv5.ttf
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/fuzz/ttf/ftstring -m ABCDEFGHIJKLMNOPQRSTUVXYZ0123456789 20 sigsegv5.ttf
Hardware watchpoint 1: *0x7fffffffba10 == 0x00060000

Old value = 0
New value = 1
0x0000000000437678 in cff_decoder_parse_charstrings (decoder=0x7fffffffba50,
    charstring_base=0x7ffff7e90c27 "\177\n\367a\373h\367\a\371+\305\001\301\367@\367\330\367@\003\372>\373\024\025\217\226\203\251\206\225\b\201u[\201d\033Yj\226\266\065\037[\243[\244j\225\277\241\273\251\252\260\b\271\301\242\325\333\032\367\064%\367+\373n%\373\tf*B\036eUyIE\032+\253%\351K\036\264n\277{\307~\236\207\255~\243z\304c\305Y\312h\bt\265\271\201\255\033\300\362\237\313\323\037\374\317\371J\025\367%\261\373\065\373\024\373\034_&C\373+R\367\033\367\062\367\035\264\353\357\037\016\227\035\016\212\n\016\204\n\016\370+\035\273\001\371w\n\367\317\367;\003@\035\016\367\003\225v\370ะป\022{\371q\373O\367O\023\340}\370\303\025\236\207\227"..., charstring_len=2)
    at /usr/local/src/freetype2/src/cff/cffgload.c:994
warning: Source file is more recent than executable.
994         *decoder->top++ = val;

Robert Swiecki <jagger>
Wed 09 Jun 2010 07:22:28 AM UTC, comment #2: 

I don't get this; however, I've already fixed #30082, maybe this makes the difference.  Please check.  Otherwise I would be glad if you could dig into this problem.

 Werner LEMBERG <wl>
Group administrator
Tue 08 Jun 2010 03:33:07 PM UTC, comment #1: 

Btw.. it crashes firefox as well..

$ LD_PRELOAD=/usr/local/src/freetype2/objs/.libs/libfreetype.so.6.4.0 LD_LIBRARY_PATH=/usr/lib/firefox-3.6.3/ /usr/lib/firefox-3.6.3/firefox-bin  http://alt.swiecki.net/j/f.php?id=sigsegv5
Segmentation fault

Bogus values of rip and rbp looks, at the first glance, as a buffer overflow to me.

 Robert Swiecki <jagger>
Tue 08 Jun 2010 03:21:35 PM UTC, original submission:  

git sources as of 2010-06-08
Linux amd64
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)

Font: http://alt.swiecki.net/j/sigsegv5.ttf

The glyph index is 49

After setting breakpoint on FT_Load_Glyph and a few continue commands

Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=48, load_flags=512) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
562     FT_Bool       autohint = FALSE;
(gdb)
Continuing.

Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=49, load_flags=516) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
562     FT_Bool       autohint = FALSE;
(gdb)
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000060000 in ?? ()

(gdb) info registers
rax            0x81 129
rbx            0x31 49
rcx            0x10000 65536
rdx            0x7fffffffd4e8 140737488344296
rsi            0x4 4
rdi            0x6f2258 7283288
rbp            0x60000 0x60000
rsp            0x7fffffffd4d0 0x7fffffffd4d0
r8             0x6cc0e0 7127264
r9             0x6cc0e0 7127264
r10            0x0 0
r11            0x7ffff7310036 140737340571702
r12            0x401fa0 4202400
r13            0x7fffffffe3c0 140737488348096
r14            0x0 0
r15            0x0 0
rip            0x60000 0x60000
eflags         0x10206 [ PF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0

(gdb) bt
#0  0x0000000000060000 in ?? ()
#1  0x0000000000070000 in ?? ()

The rbp and rip registers are smashed, so no useful stacktrace here. Let me know if you want me to provide more detailed analysis.

 Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-11 wl StatusNeed Info Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.13
    2010-06-09 wl StatusNone Need Info
        Assigned toNone wl

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-8eb0.
    Corresponding source code