bugThe FreeType Project - Bugs: bug #48979, signed integer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #48979: signed integer overflow in [@Ins_ADD]

Submitter:  Tyson Smith <twsmith>
Submitted:  Fri 02 Sep 2016 06:13:35 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.8.1

Thu 01 Jun 2017 04:28:01 PM UTC, comment #4: 

This is now fixed in git.

Werner LEMBERG <wl>
Group administrator
Tue 06 Sep 2016 03:17:12 PM UTC, comment #3: 

Yes, this could be done, together with the markup mentioned in https://savannah.nongnu.org/bugs/?46149#comment8

Another, probably better solution is to use code similar to gnulib's `intprops.h' header file (search for `Range overflow checks'), especially since recent gcc versions (and probably clang also) support overflow operator handling natively.

http://git.savannah.gnu.org/cgit/gnulib.git/tree/lib/intprops.h

Werner LEMBERG <wl>
Group administrator
Tue 06 Sep 2016 02:51:10 PM UTC, comment #2: 

We can substitute the overflow with unsigned wrap-around, which would  make it legal. Other than that there is no harm. Basically,


ADD: args[0] = (FT_Long)((FT_ULong)args[0] + (FT_ULong)args[1]);
SUB: args[0] = (FT_Long)((FT_ULong)args[0] - (FT_ULong)args[1]);


Alexei Podtelezhnikov <podtelez>
Group Member
Fri 02 Sep 2016 08:07:53 PM UTC, comment #1: 

Thanks for the report; hopefully, I'll find some time to fix this later in this year.

Werner LEMBERG <wl>
Group administrator
Fri 02 Sep 2016 06:13:35 PM UTC, original submission:  

Moving bugzilla report here. https://bugzilla.mozilla.org/show_bug.cgi?id=1295376

Found while fuzzing freetype2 commit 248f5629d8889aa5b77ea5bfce0935140293d50d (>2.6.5)

This was found while fuzzing with an Undefined Behavior Sanitizer build.

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #38409:  test_case.ttf added by twsmith (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by twsmith (Submitted the item)
  • -email is unavailable- added by twsmith
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-06-01 wl StatusPostponed Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.8.1
    2016-09-02 wl StatusNone Postponed
        Assigned toNone wl
    2016-09-02 twsmith Attached File- Added test_case.ttf, #38409
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code