The FreeType Project - Bugs: bug #43776, FreeType 2.5.3 Type42 parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43776: FreeType 2.5.3 Type42 parsing invalid free in "t42_parse_sfnts"
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Mon 08 Dec 2014 09:21:39 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.5 |
Thu 11 Dec 2014 05:50:59 PM UTC, comment #4: |
Werner LEMBERG <wl> |
Wed 10 Dec 2014 10:08:29 AM UTC, comment #3: Sure, find the fonts with more sane names reattached. |
Mateusz Jurczyk <j00ru> |
Tue 09 Dec 2014 06:00:18 AM UTC, comment #2: Mateusz, the funny file names of your attached fonts confuse Savannah, making it impossible to download them.
|
Werner LEMBERG <wl> |
Mon 08 Dec 2014 09:26:02 AM UTC, comment #1: Oops, I see FreeType 2.5.4 has been released in the meanwhile. This report of course concerns the latest version (as per using current git head). |
Mateusz Jurczyk <j00ru> |
Mon 08 Dec 2014 09:21:39 AM UTC, original submission:
The following invalid free() condition has been encountered in FreeType while fuzzing Type42 fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 12 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-12-11 | wl | Status | Need Info | Fixed | |
Privacy | Private | Public | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.5 | |||
2014-12-10 | j00ru | Attached File | - | Added 1.t42, #32635 | |
Attached File | - | Added 3.t42, #32636 | |||
Attached File | - | Added 2.t42, #32637 | |||
2014-12-09 | wl | Status | None | Need Info | |
Assigned to | None | wl | |||
2014-12-08 | j00ru | Attached File | - | Added id%3A000000,sig%3A06,src%3A011260,op%3Ahavoc,rep%3A16, #32619 | |
Attached File | - | Added id%3A000001,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A64, #32620 | |||
Attached File | - | Added id%3A000000,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A8, #32621 |
Powered by Savane 3.13-4b48.
Corresponding source code
Thanks. This was fixed a few hours ago with patches related to Savannah bug #43794.
812ed34 * src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.
c9ca6ff * src/base/ftobjs.c (FT_Get_Glyph_Name): Fix off-by-one check.
b943811 * src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.