bugThe FreeType Project - Bugs: bug #30644, Bad CFF font file causes crash

 
 

bug #30644: Bad CFF font file causes crash

Submitted by:  Chris Evans <scarybeasts>
Submitted on:  Wed 04 Aug 2010 03:21:02 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 17 Jul 2012 12:00:26 PM UTC, comment #7:

I think werner lemberg expert in bug #30644.

<a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Raksha Bandhan SMS</a> | <a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Rakhi SMS</a> | <a href="http://www.fullonsms.com/friendship-day-sms.php">Friendship Day SMS </a> | <a href="http://www.fullonsms.com/independence-day-sms.php">Independence Day SMS</a> | <a href="http://www.fullonsms.com/eid-mubarak-sms.php">Eid SMS</a>

Shaun Marsh <jack12>
Wed 04 Aug 2010 11:53:58 PM UTC, comment #6:

Werner is awesome :)

When 2.4.2 comes out, I'm pretty inspired to do some more fuzzing.

Chris Evans <scarybeasts>
Wed 04 Aug 2010 02:19:25 PM UTC, comment #5:

Aah, the crash is caused by a function in a part of FreeType which is disabled by `make devel'. I could reproduce it now, and it should be fixed in the git repository. Thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 12:46:50 PM UTC, comment #4:

Yeah.. it crashes only 64bit version for me as well (I have quite new sources from the svn)

$ gdb ./ftbench
(gdb) r -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf

Program received signal SIGSEGV, Segmentation fault.
0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
207 *cur = FT_NEXT_SHORT( p );
(gdb) bt
#0 0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
#1 0x00000000004560e1 in sfnt_load_face (stream=0x6aca00, face=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/sfnt/sfobjs.c:630
#2 0x0000000000430890 in cff_face_init (stream=0x6aca00, cffface=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/cff/cffobjs.c:495
#3 0x00000000004063ed in open_face (driver=0x6abca0, stream=0x6aca00, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe368) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#4 0x0000000000407a20 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe3e0, face_index=0, aface=0x7fffffffe500) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2041
#5 0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe93d "SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf", face_index=0, aface=0x7fffffffe500)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#6 0x0000000000402319 in get_face (face=0x7fffffffe500) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#7 0x0000000000402603 in main (argc=1, argv=0x7fffffffe620) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740

$ valgrind ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax\,_byte_\[rax\].ttf
==32181== Memcheck, a memory error detector
==32181== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32181== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==32181== Command: ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
==32181==
==32181== Invalid read of size 1
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== Address 0x402a000 is not stack'd, malloc'd or (recently) free'd
==32181==
==32181==
==32181== Process terminating with default action of signal 11 (SIGSEGV)
==32181== Access not within mapped region at address 0x402A000
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== If you believe this happened as a result of a stack
==32181== overflow in your program's main thread (unlikely but
==32181== possible), you can try to increase the size of the
==32181== main thread stack using the --main-stacksize= flag.
==32181== The main thread stack size used in this run was 8388608.
==32181==
==32181== HEAP SUMMARY:
==32181== in use at exit: 96,428 bytes in 46 blocks
==32181== total heap usage: 52 allocs, 6 frees, 99,332 bytes allocated
==32181==
==32181== LEAK SUMMARY:
==32181== definitely lost: 0 bytes in 0 blocks
==32181== indirectly lost: 0 bytes in 0 blocks
==32181== possibly lost: 0 bytes in 0 blocks
==32181== still reachable: 96,428 bytes in 46 blocks
==32181== suppressed: 0 bytes in 0 blocks
==32181== Rerun with --leak-check=full to see details of leaked memory
==32181==
==32181== For counts of detected and suppressed errors, rerun with: -v
==32181== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>
Wed 04 Aug 2010 07:50:32 AM UTC, comment #3:

Indeed, it seems to be a 64-bit issue, and I have no access to such a machine, sorry. Can you debug this?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 06:53:11 AM UTC, comment #2:

Whoops, sorry about that.

I used:
ftbench -c 1 badotf.7

This is with a 64-bit build which can make all the difference with bugs like this. A guy from Apple also confirmed he sees a crash with this file (also 64-bit looking at the stack back trace he sent me).

Chris Evans <scarybeasts>
Wed 04 Aug 2010 06:49:43 AM UTC, comment #1:

I need a recipe to reproduce the crash with one of the FreeType demo programs. Calling ftview or ftbench from FreeType 2.4.1 under GNU/Linux works just fine for me, this is, the font is correctly rejected. Valgrind doesn't show any problems either.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 03:21:02 AM UTC, original submission:

FreeType 2.4.1 seems much more robust against bad font files but the attached CFF font still causes a crash. It doesn't look like a particularly serious crash at first glance. There's a wild pointer involved but it used as the basis of a read.

Chris Evans <scarybeasts>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21135:  badotf.7 added by scarybeasts (30KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jack12 (Posted a comment)
  • -unavailable- added by jagger (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by scarybeasts (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 04 Aug 2010 02:19:25 PM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.2
    Wed 04 Aug 2010 06:49:43 AM UTCwlItem GroupNone=>Crash
      StatusNone=>Need Info
      Assigned toNone=>wl
    Wed 04 Aug 2010 03:21:02 AM UTCscarybeastsAttached File-=>Added badotf.7, #21135

    Back to the top


    Powered by Savane 3.1-cleanup1