bugThe FreeType Project - Bugs: bug #37350, Out-of-bounds read in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37350: Out-of-bounds read in T1_Get_Private_Dict

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Fri 14 Sep 2012 11:53:03 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.11

Mon 17 Sep 2012 07:00:50 PM UTC, comment #1: 

Fixed in git. Thanks for the report!

 Werner LEMBERG <wl>
Group administrator
Fri 14 Sep 2012 11:53:03 AM UTC, original submission:  

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

=================================================================
==19460== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7f43ebd58bb0 at pc 0x4eb206 bp 0x7fff58e736f0 sp 0x7fff58e736e8
READ of size 1 at 0x7f43ebd58bb0 thread T0
    #0 0x4eb205 in T1_Get_Private_Dict /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1parse.c:444
    #1 0x4e7370 in T1_Open_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1load.c:2115
    #2 0x4e09f5 in T1_Face_Init /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1objs.c:339
    #3 0x49c748 in open_face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:1154
    #4 0x49b51e in FT_Open_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:2082
    #5 0x49c3d9 in FT_New_Memory_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:1243
    #6 0x49278f in get_face /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:621
    #7 0x493008 in main /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:752
    #8 0x7f43ed1a1d5c in __libc_start_main ??:0
0x7f43ebd58bb0 is located 0 bytes to the right of 2864-byte region [0x7f43ebd58080,0x7f43ebd58bb0)
allocated by thread T0 here:
    #0 0x5d0d90 in __interceptor_malloc /proc/self/cwd/third_party/address_sanitizer/asan/asan_malloc_linux.cc:72
    #1 0x4926de in get_face /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:603
    #2 0x493008 in main /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:752
    #3 0x7f43ed1a1d5c in __libc_start_main ??:0
Shadow byte and word:
  0x1fe87d7ab176: fb
  0x1fe87d7ab170: 00 00 00 00 00 00 fb fb
More shadow bytes:
  0x1fe87d7ab150: 00 00 00 00 00 00 00 00
  0x1fe87d7ab158: 00 00 00 00 00 00 00 00
  0x1fe87d7ab160: 00 00 00 00 00 00 00 00
  0x1fe87d7ab168: 00 00 00 00 00 00 00 00
=>0x1fe87d7ab170: 00 00 00 00 00 00 fb fb
  0x1fe87d7ab178: fb fb fb fb fb fb fb fb
  0x1fe87d7ab180: fa fa fa fa fa fa fa fa
  0x1fe87d7ab188: fa fa fa fa fa fa fa fa
  0x1fe87d7ab190: fa fa fa fa fa fa fa fa
Stats: 0M malloced (0M for red zones) by 708 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 18 calls
Stats: 0M really freed by 0 calls
Stats: 24M (6146 full pages) mmaped in 6 calls
  mmaps   by size class: 8:16383; 9:8191; 10:4095; 11:2047; 12:1024; 15:128;
  mallocs by size class: 8:682; 9:17; 10:3; 11:4; 12:1; 15:1;
  frees   by size class: 8:16; 10:1; 11:1;
  rfrees  by size class:
Stats: malloc large: 0 small slow: 7
==19460== ABORTING

Testcase attached.

 Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #26554:  font.bin added by j00ru (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-09-17 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.11
    2012-09-14 j00ru Attached File- Added font.bin, #26554

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-081f.
    Corresponding source code