bugThe FreeType Project - Bugs: bug #30658, Crash - SIGSEGV (read) in...

 
 

bug #30658: Crash - SIGSEGV (read) in Mac_Read_POST_Resource->FT_Stream_Read->memcpy (in base/ftobjs.c:1616)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 05 Aug 2010 01:46:39 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: suzuki toshiya <mpsuzuki>Open/Closed: Closed
Planned Release: 2.4.2

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 06 Aug 2010 04:55:17 PM UTC, comment #5:

Thank you! Here I close this issue.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Fri 06 Aug 2010 03:37:49 PM UTC, comment #4:

Yup, looks good. Thanks

Robert Swiecki <jagger>
Fri 06 Aug 2010 05:16:18 AM UTC, comment #3:

Just I've fixed the issue on GIT head, by following patch.
Please test.

diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 9dce576..13c126f 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1574,6 +1574,7 @@
FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
i, offsets[i], rlen, flags ));

+ /* postpone the check of rlen longer than buffer until FT_Stream_Read() */
if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */
continue;

@@ -1613,6 +1614,10 @@
pfb_data[pfb_pos++] = 0;
}

+ error = FT_Err_Cannot_Open_Resource;
+ if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
+ goto Exit2;
+
error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
if ( error )
goto Exit2;

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Thu 05 Aug 2010 11:25:02 PM UTC, comment #2:

The issue is reproduced on i386 too,
thank you for reporting.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Thu 05 Aug 2010 11:15:15 PM UTC, comment #1:

Toshiya-san, please take care of it. It seems to me that in this routine some more bounding checks are missing...

Werner LEMBERG <wl>
Project Administrator
Thu 05 Aug 2010 01:46:39 PM UTC, original submission:

Font: http://alt.swiecki.net/j/f/sigsegv31.ttf

$ gdb ./ftbench
(gdb) r -c 1 sigsegv31.ttf

Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:267
267 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S
(gdb) bt
#0 memcpy () at ../sysdeps/x86_64/memcpy.S:267
#1 0x000000000040e4de in FT_Stream_ReadAt (stream=0x6aca00, pos=159050, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2 0x000000000040e428 in FT_Stream_Read (stream=0x6aca00, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3 0x0000000000406e99 in Mac_Read_POST_Resource (library=0x6a7040, stream=0x6aca00, offsets=0x6ad1f0, resource_cnt=120, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1616
#4 0x0000000000407283 in IsMacResource (library=0x6a7040, stream=0x6aca00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1747
#5 0x00000000004074f6 in IsMacBinary (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1822
#6 0x000000000040772e in load_mac_face (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1922
#7 0x0000000000407b44 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2083
#8 0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe979 "sigsegv31.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#9 0x0000000000402319 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#10 0x0000000000402603 in main (argc=1, argv=0x7fffffffe660) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740

$ valgrind ./ftbench -c 1 sigsegv31.ttf
==30068== Memcheck, a memory error detector
==30068== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==30068== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==30068== Command: ./ftbench -c 1 sigsegv31.ttf
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E5D: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9ab is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E67: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9aa is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E72: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9a9 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29E7D: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9a8 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068== at 0x4C29EBC: memcpy (mc_replace_strmem.c:497)
==30068== by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068== by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068== by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068== by 0x407282: IsMacResource (ftobjs.c:1747)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x53fd9ad is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Use of uninitialised value of size 8
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068==
==30068== Invalid write of size 8
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068==
==30068== Process terminating with default action of signal 11 (SIGSEGV)
==30068== Access not within mapped region at address 0x0
==30068== at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068== by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068== by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068== by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068== by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068== by 0x402318: get_face (ftbench.c:616)
==30068== by 0x402602: main (ftbench.c:740)
==30068== If you believe this happened as a result of a stack
==30068== overflow in your program's main thread (unlikely but
==30068== possible), you can try to increase the size of the
==30068== main thread stack using the --main-stacksize= flag.
==30068== The main thread stack size used in this run was 8388608.
==30068==
==30068== HEAP SUMMARY:
==30068== in use at exit: 22,608 bytes in 39 blocks
==30068== total heap usage: 67 allocs, 28 frees, 213,694 bytes allocated
==30068==
==30068== LEAK SUMMARY:
==30068== definitely lost: 0 bytes in 0 blocks
==30068== indirectly lost: 0 bytes in 0 blocks
==30068== possibly lost: 0 bytes in 0 blocks
==30068== still reachable: 22,608 bytes in 39 blocks
==30068== suppressed: 0 bytes in 0 blocks
==30068== Rerun with --leak-check=full to see details of leaked memory
==30068==
==30068== For counts of detected and suppressed errors, rerun with: -v
==30068== Use --track-origins=yes to see where uninitialised values come from
==30068== ERROR SUMMARY: 80166 errors from 7 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21149:  sigsegv31.ttf added by jagger (237kB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mpsuzuki (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 06 Aug 2010 04:55:17 PM UTCmpsuzukiStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 06 Aug 2010 05:16:18 AM UTCmpsuzukiStatusConfirmed=>Ready For Test
      Planned ReleaseNone=>2.4.2
    Thu 05 Aug 2010 11:25:02 PM UTCmpsuzukiStatusNone=>Confirmed
    Thu 05 Aug 2010 11:15:15 PM UTCwlAssigned toNone=>mpsuzuki
    Thu 05 Aug 2010 01:46:39 PM UTCjaggerAttached File-=>Added sigsegv31.ttf, #21149

    Back to the top


    Powered by Savane 3.1-cleanup