bugThe FreeType Project - Bugs: bug #30644, Bad CFF font file causes crash

 
 

bug #30644: Bad CFF font file causes crash

Submitted by:  Chris Evans <scarybeasts>
Submitted on:  Wed 04 Aug 2010 03:21:02 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.2

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 17 Jul 2012 12:00:26 PM UTC, comment #7:

I think werner lemberg expert in bug #30644.

<a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Raksha Bandhan SMS</a> | <a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Rakhi SMS</a> | <a href="http://www.fullonsms.com/friendship-day-sms.php">Friendship Day SMS </a> | <a href="http://www.fullonsms.com/independence-day-sms.php">Independence Day SMS</a> | <a href="http://www.fullonsms.com/eid-mubarak-sms.php">Eid SMS</a>

Shaun Marsh <jack12>
Wed 04 Aug 2010 11:53:58 PM UTC, comment #6:

Werner is awesome :)

When 2.4.2 comes out, I'm pretty inspired to do some more fuzzing.

Chris Evans <scarybeasts>
Wed 04 Aug 2010 02:19:25 PM UTC, comment #5:

Aah, the crash is caused by a function in a part of FreeType which is disabled by `make devel'. I could reproduce it now, and it should be fixed in the git repository. Thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 12:46:50 PM UTC, comment #4:

Yeah.. it crashes only 64bit version for me as well (I have quite new sources from the svn)

$ gdb ./ftbench
(gdb) r -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf

Program received signal SIGSEGV, Segmentation fault.
0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
207 *cur = FT_NEXT_SHORT( p );
(gdb) bt
#0 0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
#1 0x00000000004560e1 in sfnt_load_face (stream=0x6aca00, face=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/sfnt/sfobjs.c:630
#2 0x0000000000430890 in cff_face_init (stream=0x6aca00, cffface=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/cff/cffobjs.c:495
#3 0x00000000004063ed in open_face (driver=0x6abca0, stream=0x6aca00, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe368) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#4 0x0000000000407a20 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe3e0, face_index=0, aface=0x7fffffffe500) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2041
#5 0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe93d "SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf", face_index=0, aface=0x7fffffffe500)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#6 0x0000000000402319 in get_face (face=0x7fffffffe500) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#7 0x0000000000402603 in main (argc=1, argv=0x7fffffffe620) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740

$ valgrind ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax\,_byte_\[rax\].ttf
==32181== Memcheck, a memory error detector
==32181== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32181== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==32181== Command: ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
==32181==
==32181== Invalid read of size 1
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== Address 0x402a000 is not stack'd, malloc'd or (recently) free'd
==32181==
==32181==
==32181== Process terminating with default action of signal 11 (SIGSEGV)
==32181== Access not within mapped region at address 0x402A000
==32181== at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181== by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181== by 0x43088F: cff_face_init (cffobjs.c:495)
==32181== by 0x4063EC: open_face (ftobjs.c:1134)
==32181== by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181== by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181== by 0x402318: get_face (ftbench.c:616)
==32181== by 0x402602: main (ftbench.c:740)
==32181== If you believe this happened as a result of a stack
==32181== overflow in your program's main thread (unlikely but
==32181== possible), you can try to increase the size of the
==32181== main thread stack using the --main-stacksize= flag.
==32181== The main thread stack size used in this run was 8388608.
==32181==
==32181== HEAP SUMMARY:
==32181== in use at exit: 96,428 bytes in 46 blocks
==32181== total heap usage: 52 allocs, 6 frees, 99,332 bytes allocated
==32181==
==32181== LEAK SUMMARY:
==32181== definitely lost: 0 bytes in 0 blocks
==32181== indirectly lost: 0 bytes in 0 blocks
==32181== possibly lost: 0 bytes in 0 blocks
==32181== still reachable: 96,428 bytes in 46 blocks
==32181== suppressed: 0 bytes in 0 blocks
==32181== Rerun with --leak-check=full to see details of leaked memory
==32181==
==32181== For counts of detected and suppressed errors, rerun with: -v
==32181== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>
Wed 04 Aug 2010 07:50:32 AM UTC, comment #3:

Indeed, it seems to be a 64-bit issue, and I have no access to such a machine, sorry. Can you debug this?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 06:53:11 AM UTC, comment #2:

Whoops, sorry about that.

I used:
ftbench -c 1 badotf.7

This is with a 64-bit build which can make all the difference with bugs like this. A guy from Apple also confirmed he sees a crash with this file (also 64-bit looking at the stack back trace he sent me).

Chris Evans <scarybeasts>
Wed 04 Aug 2010 06:49:43 AM UTC, comment #1:

I need a recipe to reproduce the crash with one of the FreeType demo programs. Calling ftview or ftbench from FreeType 2.4.1 under GNU/Linux works just fine for me, this is, the font is correctly rejected. Valgrind doesn't show any problems either.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 04 Aug 2010 03:21:02 AM UTC, original submission:

FreeType 2.4.1 seems much more robust against bad font files but the attached CFF font still causes a crash. It doesn't look like a particularly serious crash at first glance. There's a wild pointer involved but it used as the basis of a read.

Chris Evans <scarybeasts>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21135:  badotf.7 added by scarybeasts (30kB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jack12 (Posted a comment)
  • -unavailable- added by jagger (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by scarybeasts (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 04 Aug 2010 02:19:25 PM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.2
    Wed 04 Aug 2010 06:49:43 AM UTCwlItem GroupNone=>Crash
      StatusNone=>Need Info
      Assigned toNone=>wl
    Wed 04 Aug 2010 03:21:02 AM UTCscarybeastsAttached File-=>Added badotf.7, #21135

    Back to the top


    Powered by Savane 3.1-cleanup