The FreeType Project - Bugs: bug #43661, FreeType 2.5.3 CFF hintmap...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43661: FreeType 2.5.3 CFF hintmap building stack-based arbitrary out-of-bounds write
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Fri 21 Nov 2014 12:45:11 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | darnold | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Wed 26 Nov 2014 07:02:21 PM UTC, comment #3: |
Dave Arnold <darnold> |
Wed 26 Nov 2014 06:23:47 PM UTC, comment #2: Dave, will be you be able to cook something up within a week? I would like to do a new FreeType release in the end of November or beginning of December... |
Werner LEMBERG <wl> |
Fri 21 Nov 2014 01:57:41 PM UTC, comment #1: Dave, please have a look. |
Werner LEMBERG <wl> |
Fri 21 Nov 2014 12:45:11 PM UTC, original submission:
There is a vulnerability in the CFF CharString interpreter used by FreeType 2.5.3 (the Adobe CFF rasterizer contributed to the project in June 2013, see [1]), which makes it possible for a specially crafted OpenType file to perform arbitrary out-of-bounds writes on the interpreter function stack. This in turn makes it possible to create a font file which takes over the program control flow and reliably executes arbitrary code included in the input file.
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 8 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-12-04 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 | |||
2014-11-21 | wl | Assigned to | None | darnold | |
2014-11-21 | j00ru | Attached File | - | Added asan_stack-oob_703c16_2728_cov_367593004_aspartam.otf, #32509 | |
Attached File | - | Added asan_stack-oob_703c16_5479_cov_4290077649_elsewher.otf, #32510 | |||
Attached File | - | Added asan_stack-oob_703c16_3507_cov_3211953920_ccapshad.otf, #32511 |
Powered by Savane 3.13-758e.
Corresponding source code
The problem is that two objects, hintMask and hStemHintArray, are getting out of sync. Once the hintMask is constructed (marked valid) no additional hints should be added to hStemHintArray. The test fonts have illegal charstrings that try to do this. There is a test for this in the interpreter, but the recovery path is incorrect and allows the arrays to be extended. Since this affects interpreter logic, I want to do more testing to ensure valid fonts are not affected by my fix.
The check that Mateusz proposes would be a "defense in depth" measure that can be added, but should never execute.
Thanksgiving holiday is this week (in the US), but I can finish the testing by next week.