bugThe FreeType Project - Bugs: bug #44364, Use-of-uninitialized-value in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #44364: Use-of-uninitialized-value in FT_DivFix

Submitter:  Jun Fang <sanqingsong>
Submitted:  Tue 24 Feb 2015 07:20:11 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Invalid Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  None

Jump to the original submission

Sat 06 Jun 2015 03:52:35 AM UTC, comment #10: 

Since there was no other reply, I accept Mateusz's analysis (thanks, by the way!), and I'm thus closing this bug report.

Werner LEMBERG <wl>
Group administrator
Mon 30 Mar 2015 01:44:27 PM UTC, comment #9: 

Another thought: the stack trace quoted by the original reporter has the following paths:

"third_party/pdfium/samples/pdfium_test.cc:553:5"
"third_party/freetype2/src/src/base/ftcalc.c:552:15"
etc.

This suggests that the freetype library linked to the pdfium_test executable used to reproduce the problem is a Chrome one, and not the one bundled with pdfium itself (which has different paths). My theory would be that the Chrome version of FreeType is old and crashes on the long-fixed bug #44462 I reported over a year ago. I'll discuss this in the Chrome bug tracker.

Mateusz Jurczyk <j00ru>
Group Member
Mon 30 Mar 2015 01:35:21 PM UTC, comment #8: 

I tried to reproduce this locally using three configurations, all compiled with MemorySanitizer:

1) ftbench utility with latest FreeType.
2) the pdfium_test utility (from the public pdfium git repo) with latest FreeType.
3) the pdfium_test utility with the embedded third_party/freetype version of the library.

I failed to reproduce this issue (and bug #44462) in all three configurations. For reference, I am attaching all font files extracted from the PDF file. If there is a bug, one of these fonts triggers it, so maybe this helps.

Another random note is that I reported very similar issues (use of uninitialized memory in the very same functions) in bug #41309 at the beginning of 2014 (FreeType 2.5.2), and they were subsequently fixed in the following commit: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=8b281f83e8516535756f92dbf90940ac44bd45e1. Maybe somehow related?

(file #33491)

Mateusz Jurczyk <j00ru>
Group Member
Wed 25 Mar 2015 03:20:03 PM UTC, comment #7: 

Any progress?  Also CCing Mateusz.

Werner LEMBERG <wl>
Group administrator
Sat 07 Mar 2015 07:22:46 AM UTC, comment #6: 

Please change Privacy to private. Thanks!

Jun Fang <sanqingsong>
Sat 07 Mar 2015 06:07:26 AM UTC, comment #5: 

Ah, I seem to have incorrectly tried to add a comment a few days ago since it is missing here.  Sorry.  Writing the comment again.

Unfortunately, file `fuzz-5.pdf' is so heavily distorted that I'm not able to extract the fonts.  Consequently, I ask you to temporarily patch the source code of `fx_ge_font.cpp', storing the buffer contents used as an argument to `FT_New_Memory_Face' into a file – of course, you should store separate calls into separate files so that we have one buffer per file.

Then please post these files (compressed if necessary) so that I can analyze them further.

Werner LEMBERG <wl>
Group administrator
Sat 07 Mar 2015 05:31:05 AM UTC, comment #4: 

Do you have any updates on this issue? If you need more information, please let me know.

Jun Fang <sanqingsong>
Wed 25 Feb 2015 05:58:25 PM UTC, comment #3: 

I shared the test file fuzz-5.pdf with you in google drive.

Jun Fang <sanqingsong>
Tue 24 Feb 2015 10:27:34 PM UTC, comment #2: 

Thanks for the patch.  However, it hides the real problem, since the array in question should always be properly assigned if there is no error.

Can you extract the font from the PDF that actually causes the warning?  Please send it to me, or attach it to this bug report.  If this doesn't work, please find out the name of the problematic font (e.g. by inserting some debug output) so that I can extract it by myself from the PDF.

Werner LEMBERG <wl>
Group administrator
Tue 24 Feb 2015 07:23:53 PM UTC, comment #1: 

It seems that the test file fuzz-5.pdf is too big to upload. If you need it, please tell me. Let me send it to you in other ways.

(file #33175)

Jun Fang <sanqingsong>
Tue 24 Feb 2015 07:20:11 PM UTC, original submission:  

The original issue was raised in Google chromium project. The version of freetype in chromium is 2.4.8. This issue is existing in the last version of freetype. I attached a patch for your reference.

You can follow the steps in http://code.google.com/p/pdfium/wiki/Build to build pdfium in linux and setup ASAN environment by following the steps in http://www.chromium.org/developers/testing/memorysanitizer.
After pdfium_test is built, please run this command:
./pdfium_test /home/foxit/Downloads/fuzz-5.pdf 2>&1 | ../../tools/valgrind/asan/asan_symbolize.py

Rendering PDF file /mnt/scratch0/clusterfuzz/slave-bot/inputs/fuzzer-testcases-disk/fuzz-5.pdf.
Non-linearized path...
==8225== WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7fb27a75065e in FT_DivFix third_party/freetype2/src/src/base/ftcalc.c:552:15
    #1 0x7fb27a8dbccf in parse_font_matrix third_party/freetype2/src/src/type1/t1load.c:1133:17
    #2 0x7fb27a8d9e62 in t1_load_keyword third_party/freetype2/src/src/type1/t1load.c:937:7
    #3 0x7fb27a8d9e62 in parse_dict third_party/freetype2/src/src/type1/t1load.c:1983
    #4 0x7fb27a8cb6eb in T1_Open_Face third_party/freetype2/src/src/type1/t1load.c:2091:13
    #5 0x7fb27a8cb6eb in T1_Face_Init third_party/freetype2/src/src/type1/t1objs.c:321
    #6 0x7fb27a761947 in open_face third_party/freetype2/src/src/base/ftobjs.c:1149:15
    #7 0x7fb27a75e367 in FT_Open_Face third_party/freetype2/src/src/base/ftobjs.c:2076:19
    #8 0x7fb27a761289 in FT_New_Memory_Face third_party/freetype2/src/src/base/ftobjs.c:1238:12
    #9 0x7fb27b4d0b7f in FT_LoadFont third_party/pdfium/core/src/fxge/ge/fx_ge_font.cpp:170:17
    #10 0x7fb27b4d0b7f in CFX_Font::LoadEmbedded(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxge/ge/fx_ge_font.cpp:187
    #11 0x7fb27ae47794 in CPDF_Font::LoadFontDescriptor(CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:299:9
    #12 0x7fb27ae524a1 in CPDF_SimpleFont::LoadCommon() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:949:9
    #13 0x7fb27ae55513 in CPDF_Type1Font::_Load() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:1068:12
    #14 0x7fb27ae4ec81 in CPDF_Font::Load() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:494:12
    #15 0x7fb27ae4e5e3 in CPDF_Font::CreateFontF(CPDF_Document*, CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:478:10
    #16 0x7fb27aea8a4c in CPDF_DocPageData::GetFont(CPDF_Dictionary*, int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:307:24
    #17 0x7fb27aea85f8 in CPDF_Document::LoadFont(CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:85:12
    #18 0x7fb27aeef599 in CPDF_StreamContentParser::FindFont(CFX_ByteString const&) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1216:24
    #19 0x7fb27aeef1e2 in CPDF_StreamContentParser::Handle_SetFont() third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1176:24
    #20 0x7fb27aed585a in CPDF_StreamContentParser::OnOperator(char const*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:341:13
    #21 0x7fb27aef6f84 in CPDF_StreamContentParser::Parse(unsigned char const*, unsigned int, unsigned int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:62:21
    #22 0x7fb27af05ef6 in CPDF_ContentParser::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:1091:36
    #23 0x7fb27ae8b458 in ContinueParse third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page.cpp:704:5
    #24 0x7fb27ae8b458 in CPDF_Page::ParseContent(CPDF_ParseOptions*, int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page.cpp:906
    #25 0x7fb27ad4316a in FPDF_LoadPage third_party/pdfium/fpdfsdk/src/fpdfview.cpp:311:2
    #26 0x7fb27ad3914f in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:440:22
    #27 0x7fb27ad3b433 in main third_party/pdfium/samples/pdfium_test.cc:553:5
    #28 0x7fb2794b6ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #29 0x7fb27ace8b1e in _start

  Uninitialized value was created by an allocation of temp in the stack frame of function parse_font_matrix
    #0 0x7fb27a8db7e0 in parse_font_matrix third_party/freetype2/src/src/type1/t1load.c:1092

SUMMARY: MemorySanitizer: use-of-uninitialized-value ??:0 ??
Exiting

Jun Fang <sanqingsong>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #33491:  fuzz-5-fonts.zip added by j00ru (335KiB - application/octet-stream)
file #33175:  diff_t1load.c added by sanqingsong (436B - text/plain)
file #33174:  diff_t1load.c added by sanqingsong (436B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by j00ru (Updated the item)
  • -email is unavailable- added by wl
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by sanqingsong (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-08-22 wl PrivacyPrivate Public
    2015-06-06 wl StatusNeed Info Invalid
        Open/ClosedOpen Closed
    2015-03-30 j00ru Attached File- Added fuzz-5-fonts.zip, #33491
    2015-03-25 wl Carbon-Copy- Added j00ru
    2015-03-07 wl PrivacyPublic Private
    2015-02-24 wl StatusNone Need Info
        Assigned toNone wl
    2015-02-24 sanqingsong Attached File- Added diff_t1load.c, #33175
    2015-02-24 sanqingsong Attached File- Added diff_t1load.c, #33174

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code