bugThe FreeType Project - Bugs: bug #35659, Negative num_glyphs returned by...

 
 

bug #35659: Negative num_glyphs returned by FT_New_Face

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Tue 28 Feb 2012 10:37:33 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.9

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 01 Mar 2012 08:34:37 PM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 28 Feb 2012 10:37:33 AM UTC, original submission:

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

This particular issue is quite interesting, as it involves both freetype2 and the client application using it. For the sample which triggers the bug, the FT_New_Face function returns num_glyphs = -20. The value is later used to perform a memory allocation:

advanced = (FT_Fixed *)calloc( sizeof ( FT_Fixed ), face->num_glyphs );

and directly passes the pointer to FT_Get_Advances, even if the allocation failed and returned NULL. I believe that FT_New_Face returning a negative count of glyphs without an error might be a bug itself; I haven't done any investigation here, but depending on how controlled the num_glyphs field can be based on the source font, it might be possible to specially craft it to cause an integer overflow in an allocation like the one in ftbench, present in a real client application. This, in turn, might result in a memory corruption and an exploitable condition.

Log from Valgrind:

==20401== Memcheck, a memory error detector
==20401== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==20401== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==20401== Command: ./ftbench tmp/freetype_run2/cu12.fon.c95.437
==20401==
Load : inf us/op
Load_Advances (Normal) : ==20401== Invalid write of size 8
==20401== at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401== by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401== by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401== by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==20401==
==20401==
==20401== Process terminating with default action of signal 11 (SIGSEGV)
==20401== Access not within mapped region at address 0x0
==20401== at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401== by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401== by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401== by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401== If you believe this happened as a result of a stack
==20401== overflow in your program's main thread (unlikely but
==20401== possible), you can try to increase the size of the
==20401== main thread stack using the --main-stacksize= flag.
==20401== The main thread stack size used in this run was 8388608.
==20401==
==20401== HEAP SUMMARY:
==20401== in use at exit: 30,988 bytes in 55 blocks
==20401== total heap usage: 81 allocs, 26 frees, 42,786 bytes allocated
==20401==
==20401== LEAK SUMMARY:
==20401== definitely lost: 0 bytes in 0 blocks
==20401== indirectly lost: 0 bytes in 0 blocks
==20401== possibly lost: 0 bytes in 0 blocks
==20401== still reachable: 30,988 bytes in 55 blocks
==20401== suppressed: 0 bytes in 0 blocks
==20401== Rerun with --leak-check=full to see details of leaked memory
==20401==
==20401== For counts of detected and suppressed errors, rerun with: -v
==20401== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)

Mateusz Jurczyk <j00ru>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #25205:  cu12.fon.c95.437 added by j00ru (7kB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 01 Mar 2012 08:34:37 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.9
    Tue 28 Feb 2012 10:37:33 AM UTCj00ruAttached File-=>Added cu12.fon.c95.437, #25205

    Back to the top


    Powered by Savane 3.1-cleanup