The FreeType Project - Bugs: bug #59308, Heap buffer overflow due to...
You are not allowed to post comments on this tracker with your current authentication level.
bug #59308: Heap buffer overflow due to integer truncation in Load_SBit_Png
Submitter: | Sergei Glazunov <glazunov> | ||
Submitted: | Mon 19 Oct 2020 08:25:43 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.10.4 |
( Jump to the original submission )
Spam posted by _311721 | |
Mon 19 Oct 2020 10:19:13 PM UTC, comment #5: |
bungeman <bungeman> |
Mon 19 Oct 2020 10:16:57 PM UTC, comment #4: I see change https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/ChangeLog?id=a3bab162b2ae616074c8877a04556932998aeacd "[sfnt] Fix heap buffer overflow (#59308)." but it seems to be just a changelog entry and doesn't seem to have the change to pnhshim.c? |
bungeman <bungeman> |
Mon 19 Oct 2020 09:25:59 PM UTC, comment #3: Thank you for the prompt reply! I can confirm that your patch prevents the crash. Just in case, I'm attaching the same font file in a password protected zip archive (pw: infected). |
Sergei Glazunov <glazunov> |
Mon 19 Oct 2020 09:21:33 PM UTC, comment #2: Too bad that the fuzzer run by the Chrome people didn't catch that in the last few years... |
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 09:09:14 PM UTC, comment #1: For some unknown reason I'm not able to download the testcase font; however, here's a patch that should fix the issue – please test!
|
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 08:25:43 PM UTC, original submission:
A heap buffer overflow vulnerability exists due to integer truncation in Load_SBit_Png.
VULNERABILITY DETAILS
[...]
png_get_IHDR( png, info,
[...]
if ( populate_map_and_metrics )
map->width = metrics->width;
[...]
if ( populate_map_and_metrics )
error = ft_glyphslot_alloc_bitmap( slot, size ); // *** 4 ***
[...]
png_read_image( png, rows ); // *** 5 ***
A vulnerability exists in the function `Load_SBit_Png`, which processes PNG images embedded into fonts. This function:
1) Obtains the image width and height from the header as 32-bit integers.
The issue is that libpng uses the original 32-bit values, which are saved in `png_struct`. Therefore, if the original width and/or height are greater than 65535, the allocated buffer won't be able to fit the bitmap.
I've verified that the emergency fix below breaks the proof-of-concept, but a long-term patch will require a more thorough code review:
```
+ /* bail out if the width and/or height were truncated */
REPRODUCTION CASE
=================================================================
0x61d00002ba60 is located 60 bytes to the right of 1956-byte region [0x61d00002b280,0x61d00002ba24)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/user/libpng/.libs/libpng16.so.16+0x9f36e) in png_combine_row
Note that this vulnerability was originally reported to Google Chrome today (2020-10-19) under
This issue has been assigned CVE-2020-15999.
CREDIT INFORMATION
|
Sergei Glazunov <glazunov> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-10-19 | wl | Status | None | ![]() |
Fixed |
Privacy | Private | ![]() |
Public | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.10.4 | ||
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.zip, #50023 |
2020-10-19 | wl | Assigned to | None | ![]() |
wl |
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.ttf, #50021 |
Attached File | - | ![]() |
Added asan.log, #50022 | ||
Carbon-Copy | - | ![]() |
Added hawkes |
Also, good to know that the suggested change in comment #1 is almost exactly what is being used to patch this in Chromium at the moment (e.g. https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+/refs/heads/chromium/branch-heads/4240%5E%21/#F0 ). (Only difference being the order of imgWidth and imgHeight tests.)