bugThe FreeType Project - Bugs: bug #44462, Use-of-uninitialized-value in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #44462: Use-of-uninitialized-value in FT_RoundFix

Submitter:  Jun Fang <sanqingsong>
Submitted:  Sat 07 Mar 2015 07:39:09 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Invalid Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  None

Sat 06 Jun 2015 03:51:51 AM UTC, comment #3: 

Since there was no other reply, I accept Mateusz's analysis (thanks, by the way!), and I'm thus closing this bug report.

Werner LEMBERG <wl>
Group administrator
Mon 30 Mar 2015 01:47:42 PM UTC, comment #2: 

Just a quick status update: please see my recent comments in bug #44364, which I think also apply here (it's likely the same bug).

In any case, I'm still attaching fonts extracted from the fuzz-140.pdf file, if they turn out to be relevant.

(file #33492)

Mateusz Jurczyk <j00ru>
Group Member
Wed 25 Mar 2015 03:06:07 PM UTC, comment #1: 

Mateusz, can you have a look, please?  It's not possible for me to reproduce this issue (I neither have access to the private Chromium bug report, nor do I have knowledge of pdfium, which is a huge project).

While Jun's patch certainly works, it hides the real issue, if there is one.  In file `psaux/psobjs.c', line 821 (in function `ps_tocoordarray'), the elements are always assigned, and the calling function `ps_parser_load_field', line 1199, correctly exits if the number of arguments is less than 4.  I don't see a possibility with the git version of FreeType that the reported problem can happen at all.

Do I miss something?

Werner LEMBERG <wl>
Group administrator
Sat 07 Mar 2015 07:39:09 AM UTC, original submission:  

The original bug was reported in https://code.google.com/p/chromium/issues/detail?can=2&q=454426&colspec=ID%20Pri%20M%20Week%20ReleaseBlock%20Cr%20Status%20Owner%20Summary%20OS%20Modified&id=454426. Below is the dumped information using MSAN. I attach a patch for your reference.

==25821== WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7fbfd1717269 in FT_RoundFix third_party/freetype2/src/src/base/ftcalc.c:81:5
    #1 0x7fbfd18cf1b5 in ps_parser_load_field third_party/freetype2/src/src/psaux/psobjs.c:1206:24
    #2 0x7fbfd18a1a2e in t1_load_keyword third_party/freetype2/src/src/type1/t1load.c:1019:15
    #3 0x7fbfd18a1a2e in parse_dict third_party/freetype2/src/src/type1/t1load.c:1983
    #4 0x7fbfd189315b in T1_Open_Face third_party/freetype2/src/src/type1/t1load.c:2091:13
    #5 0x7fbfd189315b in T1_Face_Init third_party/freetype2/src/src/type1/t1objs.c:321
    #6 0x7fbfd1729947 in open_face third_party/freetype2/src/src/base/ftobjs.c:1149:15
    #7 0x7fbfd1726367 in FT_Open_Face third_party/freetype2/src/src/base/ftobjs.c:2076:19
    #8 0x7fbfd1729289 in FT_New_Memory_Face third_party/freetype2/src/src/base/ftobjs.c:1238:12
    #9 0x7fbfd24996bf in FT_LoadFont third_party/pdfium/core/src/fxge/ge/fx_ge_font.cpp:170:17
    #10 0x7fbfd24996bf in CFX_Font::LoadEmbedded(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxge/ge/fx_ge_font.cpp:187
    #11 0x7fbfd1dffbb4 in CPDF_Font::LoadFontDescriptor(CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:299:9
    #12 0x7fbfd1e0a8d1 in CPDF_SimpleFont::LoadCommon() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:949:9
    #13 0x7fbfd1e0d943 in CPDF_Type1Font::_Load() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:1068:12
    #14 0x7fbfd1e070b1 in CPDF_Font::Load() third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:494:12
    #15 0x7fbfd1e06a13 in CPDF_Font::CreateFontF(CPDF_Document*, CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_font/fpdf_font.cpp:478:10
    #16 0x7fbfd1e6322c in CPDF_DocPageData::GetFont(CPDF_Dictionary*, int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:307:24
    #17 0x7fbfd1e62dd8 in CPDF_Document::LoadFont(CPDF_Dictionary*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:85:12
    #18 0x7fbfd1ea9eb9 in CPDF_StreamContentParser::FindFont(CFX_ByteString const&) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1216:24
    #19 0x7fbfd1ea9b02 in CPDF_StreamContentParser::Handle_SetFont() third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1176:24
    #20 0x7fbfd1e9018a in CPDF_StreamContentParser::OnOperator(char const*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp:341:13
    #21 0x7fbfd1eb18a4 in CPDF_StreamContentParser::Parse(unsigned char const*, unsigned int, unsigned int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:62:21
    #22 0x7fbfd1ec0836 in CPDF_ContentParser::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:1091:36
    #23 0x7fbfd1e45cd8 in ContinueParse third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page.cpp:704:5
    #24 0x7fbfd1e45cd8 in CPDF_Page::ParseContent(CPDF_ParseOptions*, int) third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page.cpp:906
    #25 0x7fbfd1d0600a in FPDF_LoadPage third_party/pdfium/fpdfsdk/src/fpdfview.cpp:310:2
    #26 0x7fbfd1cfc14f in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:421:22
    #27 0x7fbfd1cfe400 in main third_party/pdfium/samples/pdfium_test.cc:528:5
    #28 0x7fbfd0490ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #29 0x7fbfd1cac1da in _start
  Uninitialized value was created by an allocation of temp in the stack frame of function ps_parser_load_field
    #0 0x7fbfd18ce500 in ps_parser_load_field third_party/freetype2/src/src/psaux/psobjs.c:1029

SUMMARY: MemorySanitizer: use-of-uninitialized-value ??:0 ??
Exiting

Jun Fang <sanqingsong>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #33492:  fuzz-140-fonts.zip added by j00ru (95KiB - application/octet-stream)
file #33276:  diff_psobjs.c added by sanqingsong (347B - text/x-csrc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by j00ru (Updated the item)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by wl
  • -email is unavailable- added by sanqingsong (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-08-22 wl PrivacyPrivate Public
    2015-06-06 wl StatusNeed Info Invalid
        Open/ClosedOpen Closed
    2015-03-30 j00ru Attached File- Added fuzz-140-fonts.zip, #33492
    2015-03-25 wl StatusNone Need Info
        Assigned toNone wl
        Carbon-Copy- Added j00ru
    2015-03-07 sanqingsong Attached File- Added diff_psobjs.c, #33276

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code