bugThe FreeType Project - Bugs: bug #30361, Possible heap corruption

 
 

bug #30361: Possible heap corruption

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Mon 05 Jul 2010 10:08:20 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 08 Jul 2010 07:35:04 PM UTC, comment #5:

Will do so finally in the next few days.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 08 Jul 2010 02:20:30 PM UTC, comment #4:

Btw, are you maybe going with a new release of the freetype2 anytime soon?. I've pinged a few OS vendors to pick-up patches or upgrade to the newest release as soon as it's out, just wondering if this newest release might appear soon.

Robert Swiecki <jagger>
Thu 08 Jul 2010 01:03:20 PM UTC, comment #3:

Perfect, no warnings, thanks.

Robert Swiecki <jagger>
Thu 08 Jul 2010 05:31:20 AM UTC, comment #2:

Fixed in git. Please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 06 Jul 2010 01:36:53 PM UTC, comment #1:

Ooppsss. it's just invalid pointer to realloc, I was grepping for wrong address in the previous example:

$ MALLOC_CHECK_=2 LD_PRELOAD=./libdalloc.so ./ftbench -c 1 sigabrt28.ttf | grep 6af560
REALLOC: PTR: 0x6afd00 SIZE: 1024, RET: 0x6af560

So, the 0x6af560 (in my case) is realloc()ated, but it had never been malloc()ed or calloc()ed before.

Robert Swiecki <jagger>
Mon 05 Jul 2010 10:08:20 PM UTC, original submission:

I think that's really the last one :)

gcc -O0 -g
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), Linux amd64
File: http://alt.swiecki.net/j/f/sigabrt28.ttf

The address passed to realloc() seems valid, I debugged it with simple memory debugger (a preloaded lib intercepting malloc, free, calloc, realloc), and it's been allocated, so the only reasonable answer to this for me must be corruption of the heap metadata (typically buffer overflow)

$ MALLOC_CHECK_=3 LD_PRELOAD=./libdalloc.so ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf | grep 6af500
MALLOC: SIZE: 8, RET: 0x6af500
REALLOC: PTR: 0x6af500 SIZE: 16, RET: 0x6af500

      • glibc detected *** ./ftbench: realloc(): invalid pointer: 0x00000000006af560 ***

======= Backtrace: =========
...

and the full output w/o libdalloc.so

$ MALLOC_CHECK_=3 ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
Load : *** glibc detected *** ./ftbench: realloc(): invalid pointer: 0x00000000006af560 ***
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7ffff78b95b6]
/lib/libc.so.6(+0x7ed33)[0x7ffff78c0d33]
./ftbench[0x47ed95]
./ftbench[0x410238]
./ftbench[0x4100dc]
./ftbench[0x4045fc]
./ftbench[0x412c73]
./ftbench[0x4150b5]
./ftbench[0x416526]
./ftbench[0x4118bf]
./ftbench[0x405a52]
./ftbench[0x4017c4]
./ftbench[0x4016fe]
./ftbench[0x40275f]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ffff7860c4d]
./ftbench[0x4014e9]
======= Memory map: ========
00400000-004a6000 r-xp 00000000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a5000-006a6000 r--p 000a5000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a6000-006a7000 rw-p 000a6000 08:06 25976833 /usr/local/google/fuzz/ttf/ftbench
006a7000-006c8000 rw-p 00000000 00:00 0 [heap]
7ffff762b000-7ffff7641000 r-xp 00000000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7641000-7ffff7840000 ---p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7840000-7ffff7841000 r--p 00015000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7841000-7ffff7842000 rw-p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7842000-7ffff79bc000 r-xp 00000000 08:01 1352099 /lib/libc-2.11.1.so
7ffff79bc000-7ffff7bbb000 ---p 0017a000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbb000-7ffff7bbf000 r--p 00179000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbf000-7ffff7bc0000 rw-p 0017d000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bc0000-7ffff7bc5000 rw-p 00000000 00:00 0
7ffff7bc5000-7ffff7bdb000 r-xp 00000000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7bdb000-7ffff7dda000 ---p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7dda000-7ffff7ddb000 r--p 00015000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddb000-7ffff7ddc000 rw-p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0
7ffff7fee000-7ffff7fef000 rw-p 00000000 00:00 0
7ffff7fef000-7ffff7ff9000 r--p 00000000 08:06 25976849 /usr/local/google/fuzz/ttf/SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

valgrind:

$ valgrind ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205== Memcheck, a memory error detector
==23205== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==23205== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==23205== Command: ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205==
==23205== Invalid read of size 1
==23205== at 0x41EE93: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6773
==23205== by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205== by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205== by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205== by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205== by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205== by 0x40275E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:782
==23205== Address 0x53d28f0 is 0 bytes after a block of size 64 alloc'd
==23205== at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205== by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205== by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205== by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205== by 0x40463A: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:225
==23205== by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205== by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205== Invalid write of size 8
==23205== at 0x41ECEE: _iup_worker_interpolate /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6700
==23205== by 0x41EF1F: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6791
==23205== by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205== by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205== by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205== by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205== by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205== Address 0x53d2870 is 0 bytes after a block of size 1,024 alloc'd
==23205== at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205== by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205== by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205== by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205== by 0x4045FB: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
==23205== by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205== by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205== by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205== by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205== by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205== by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205== by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205==
==23205== HEAP SUMMARY:
==23205== in use at exit: 0 bytes in 0 blocks
==23205== total heap usage: 2,031 allocs, 2,031 frees, 340,840 bytes allocated
==23205==
==23205== All heap blocks were freed -- no leaks are possible
==23205==
==23205== For counts of detected and suppressed errors, rerun with: -v
==23205== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 4 from 0)

gdb:

$ MALLOC_CHECK_=3 gdb ./ftbench
(gdb) r -c 1 sigabrt28.ttf

Program received signal SIGABRT, Aborted.
0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c

(gdb) bt
#0 0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff78795c0 in *__GI_abort () at abort.c:92
#2 0x00007ffff78af4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff78b95b6 in malloc_printerr (action=3, str=0x7ffff7989bee "realloc(): invalid pointer", ptr=<value optimized out>) at malloc.c:6264
#4 0x00007ffff78c0d33 in realloc_check (oldmem=0x6af560, bytes=1280, caller=<value optimized out>) at hooks.c:330
#5 0x000000000047ed95 in ft_realloc (memory=0x6a7010, cur_size=1024, new_size=1280, block=0x6af560) at builds/unix/ftsystem.c:135
#6 0x0000000000410238 in ft_mem_qrealloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe28c) at /usr/local/google/src/freetype2/src/base/ftutil.c:154
#7 0x00000000004100dc in ft_mem_realloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe2e8) at /usr/local/google/src/freetype2/src/base/ftutil.c:101
#8 0x00000000004045fc in FT_GlyphLoader_CheckPoints (loader=0x6add50, n_points=77, n_contours=0) at /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
#9 0x0000000000412c73 in TT_Load_Simple_Glyph (load=0x7fffffffe550) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
#10 0x00000000004150b5 in load_truetype_glyph (loader=0x7fffffffe550, glyph_index=8, recurse_count=0, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
#11 0x0000000000416526 in TT_Load_Glyph (size=0x6ade10, glyph=0x6adbb0, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
#12 0x00000000004118bf in Load_Glyph (ttslot=0x6adbb0, ttsize=0x6ade10, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
#13 0x0000000000405a52 in FT_Load_Glyph (face=0x6acb40, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#14 0x00000000004017c4 in test_load (timer=0x7fffffffe870, face=0x6acb40, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:219
#15 0x00000000004016fe in benchmark (face=0x6acb40, test=0x7fffffffe8e0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#16 0x000000000040275f in main (argc=1, argv=0x7fffffffea50) at /usr/local/google/src/freetype2-demos/src/ftbench.c:782

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20903:  sigabrt28.ttf added by jagger (38kB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 08 Jul 2010 05:31:20 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Mon 05 Jul 2010 10:08:20 PM UTCjaggerAttached File-=>Added sigabrt28.ttf, #20903

    Back to the top


    Powered by Savane 3.1-cleanup