bugThe FreeType Project - Bugs: bug #41693, Out-of-bounds read in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #41693: Out-of-bounds read in cff_fd_select_get

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Tue 25 Feb 2014 07:15:05 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.5.3

Wed 26 Feb 2014 01:20:58 PM UTC, comment #2: 

Fixed in git.  Thanks for the report.

BTW, the reason for not being able to attach your sample files is that they are too large.  Somehow the advertised 16384kByte size limit for attachments is not correct; this is a bug in Savannah itself, as far as I know.

 Werner LEMBERG <wl>
Group administrator
Tue 25 Feb 2014 07:21:11 PM UTC, comment #1: 

I'm not sure why I cannot attach sample files, they are available at:

http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_9202_sigsegv1.ttf
http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_9201_sigsegv1.ttf
http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_123_12009.22432.otf

 Mateusz Jurczyk <j00ru>
Group Member
Tue 25 Feb 2014 07:15:05 PM UTC, original submission:  

Tested on Ubuntu AMD64 with upstream FreeType2 and FreeType2-demos using ./ftbench <file>:

=================================================================
==25103==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edb2 at pc 0x6a61ec bp 0x7fff1b272510 sp 0x7fff1b272508
READ of size 1 at 0x60200000edb2 thread T0
    #0 0x6a61eb in cff_fd_select_get freetype2/src/cff/cffload.c:744
    #1 0x69f94a in cff_slot_load freetype2/src/cff/cffgload.c:2762
    #2 0x66b8b0 in cff_glyph_load freetype2/src/cff/cffdrivr.c:185
    #3 0x4a28e2 in FT_Load_Glyph freetype2/src/base/ftobjs.c:726
    #4 0x492475 in test_load freetype2-demos/src/ftbench.c:249
    #5 0x4930e7 in benchmark freetype2-demos/src/ftbench.c:216
    #6 0x48f692 in main freetype2-demos/src/ftbench.c:1020

0x60200000edb2 is located 0 bytes to the right of 2-byte region [0x60200000edb0,0x60200000edb2)
allocated by thread T0 here:
    #0 0x474821 in __interceptor_malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0xa6611f in ft_alloc freetype2/src/base/ftsystem.c:74
    #2 0x519409 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
    #3 0x518121 in FT_Stream_EnterFrame freetype2/src/base/ftstream.c:267
    #4 0x517a05 in FT_Stream_ExtractFrame freetype2/src/base/ftstream.c:200
    #5 0x6839e6 in CFF_Load_FD_Select freetype2/src/cff/cffload.c:695
    #6 0x6782a2 in cff_font_load freetype2/src/cff/cffload.c:1585
    #7 0x6615ff in cff_face_init freetype2/src/cff/cffobjs.c:582
    #8 0x4c95ce in open_face freetype2/src/base/ftobjs.c:1191
    #9 0x4c57cd in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #10 0x4c3ca4 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #11 0x491d0f in get_face freetype2-demos/src/ftbench.c:705
    #12 0x48e6c4 in main freetype2-demos/src/ftbench.c:924

SUMMARY: AddressSanitizer: heap-buffer-overflow freetype2/src/cff/cffload.c:744 cff_fd_select_get
Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa 00 00 fa fa 00 01
=>0x0c047fff9db0: fa fa fd fa fa fa[02]fa fa fa fd fd fa fa fd fd
  0x0c047fff9dc0: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa 00 06
  0x0c047fff9dd0: fa fa 00 01 fa fa 00 00 fa fa fd fd fa fa fd fa
  0x0c047fff9de0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 fa
  0x0c047fff9df0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      =25103==ABORTING

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-26 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.5.3

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code