bugThe FreeType Project - Bugs: bug #30249, Heap corruption in base/* (Mac...

 
 

bug #30249: Heap corruption in base/* (Mac fonts related functions)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 24 Jun 2010 09:17:09 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: suzuki toshiya <mpsuzuki>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 01 Jul 2010 08:54:50 AM UTC, comment #8:

I added additional buffer size checking
(at present, FreeType2 believes the
total size of PFB declared in header,
allocates the buffer by declared size,
and does not check overrun by putting
too long fragments). I close this issue.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Wed 30 Jun 2010 03:46:50 PM UTC, comment #7:

I'm sorry, please wait 48 hours.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Wed 30 Jun 2010 03:40:12 PM UTC, comment #6:

Hey,

I propose you close this and #30248 bugs, as it seems that the core issues has been fixed, and I'll file another bug with the remaining issues, just to have clear situation over what to fix in the max fonts parsing routines.

Robert Swiecki <jagger>
Fri 25 Jun 2010 02:17:25 PM UTC, comment #5:

It doesn't throw any errors for me now. It seems that I overestimated the amount of work required to make it fixed. Thanks for looking into this.

Robert Swiecki <jagger>
Fri 25 Jun 2010 01:36:46 AM UTC, comment #4:

When it have been committed I'll give it a try one more time. It's interesting that lack of just one check leads to so many troubles ;).

Robert Swiecki <jagger>
Fri 25 Jun 2010 01:32:13 AM UTC, comment #3:

The patch for bug #30248
https://savannah.nongnu.org/bugs/download.php?file_id=20815
makes FreeType2 stand with this font.
Yet I'm not sure the exact scenario why #30248 causes SEGV
but #30249 causes silent heap corruption, so I leave this bug
as another (not duplicated) bug.

It seems that, when an error occurs (FT_Stream_Read() got
shorter data than requested) just before the loop that SEGV
or heap corruption occurs. ...So, checking FT_Stream_Read()
makes FreeType2 stand with these fonts.

Please wait my next report. Anyway, I will commit the patch
before full investigation.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Fri 25 Jun 2010 12:53:38 AM UTC, comment #2:

Cool, thanks for looking into this.

BTW, this heap corruption ends up with a crash only under specific conditions. I usually test it in the following way: (on Linux)

MALLOC_CHECK_=3 ./ftbench -c 1 <font_file>

Then, if glibc's memory management subsystem detects a malloc()-related issue, it kills the process with SIGABRT (raise(SIGABRT)).

Obviously, similar effect can be observed in valgrind, which reports heap structure corruption issues; and valgrind should be even more reliable here.

Robert Swiecki <jagger>
Fri 25 Jun 2010 12:41:52 AM UTC, comment #1:

For first, thank you for reporting the issue in
MacOS related functionalities. I will check.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Thu 24 Jun 2010 09:17:09 PM UTC, original submission:

gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"

Font: http://alt.swiecki.net/j/f/sigabrt17.font

There's heap corruption somewhere in Mac font parsing functions. It might be related to: https://savannah.nongnu.org/bugs/?30248

I feel that these functions might need some serious amount of work to make them behave correctly.

$ valgrind ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x11020000002bb.INSTR.cmp_rax,_0xfffff000.ttf

==1703== Memcheck, a memory error detector
==1703== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==1703== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==1703== Command: ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x11020000002bb.INSTR.cmp_rax,_0xfffff000.ttf
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb141 is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb140 is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb13f is not stack'd, malloc'd or (recently) free'd
==1703==
==1703== Invalid write of size 1
==1703== at 0x4C2AA11: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==1703== by 0x40F451: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==1703== by 0x40F39B: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==1703== by 0x407E87: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==1703== Address 0x55bb13e is not stack'd, malloc'd or (recently) free'd
==1703==

valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 18446744073709486080, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.

==1703== at 0x3802CA47: report_and_quit /tmp/vg/coregrind/m_libcassert.c:191
==1703== by 0x3802CC73: vgPlain_assert_fail /tmp/vg/coregrind/m_libcassert.c:265
==1703== by 0x3803800B: vgPlain_arena_malloc /tmp/vg/coregrind/m_mallocfree.c:246
==1703== by 0x38002DD4: vgMemCheck_new_block /tmp/vg/memcheck/mc_malloc_wrappers.c:199
==1703== by 0x380031D9: vgMemCheck_malloc /tmp/vg/memcheck/mc_malloc_wrappers.c:236
==1703== by 0x3806872E: vgPlain_scheduler /tmp/vg/coregrind/m_scheduler/scheduler.c:1384
==1703== by 0x3808EA10: run_a_thread_NORETURN /tmp/vg/coregrind/m_syswrap/syswrap-linux.c:94

sched status:
running_tid=1

Thread 1: status = VgTs_Runnable
==1703== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==1703== by 0x480BF7: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==1703== by 0x410FCE: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==1703== by 0x410F56: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==1703== by 0x407677: new_memory_stream /usr/local/google/src/freetype2/src/base/ftobjs.c:1271
==1703== by 0x407723: open_face_from_buffer /usr/local/google/src/freetype2/src/base/ftobjs.c:1301
==1703== by 0x407F47: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1588
==1703== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==1703== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==1703== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==1703== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==1703== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==1703== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==1703== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20813:  sigabrt17.font added by jagger (22kB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mpsuzuki (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 01 Jul 2010 08:54:50 AM UTCmpsuzukiStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Fri 25 Jun 2010 01:32:13 AM UTCmpsuzukiStatusNone=>In Progress
    Fri 25 Jun 2010 12:41:52 AM UTCmpsuzukiAssigned toNone=>mpsuzuki
    Thu 24 Jun 2010 09:17:09 PM UTCjaggerAttached File-=>Added sigabrt17.font, #20813

    Back to the top


    Powered by Savane 3.1-cleanup