Update: you can use CVE-2014-2240 as the identifier of the vulnerability.

You can also use CVE-2014-2241 for the other fix you submitted in relation to this bug, if required (not necessary).

Thanks,
Mateusz

Thanks a lot for the patches!  They are now in the git repository.  Right now I'm preparing a new release, to be available in one or two days, I guess.

Is there a CVE number already available?

Thanks, it now crashes properly :-)

Thanks for the report.  Are you sure this is the right font?  Dave Arnold can't reproduce it (and me neither, but I don't have a 64bit system – however, I get an assertion at a different place, something that should be fixed also).

It would be very helpful if you could play with ftbench's -i option to help us find the triggering glyph index.

Tested on Ubuntu AMD64 with upstream FreeType2 and FreeType2-demos, reproduced with ./ftbench <file>.

This is a critical vulnerability in the CFF Rasterizer code recently contributed by Adobe, leading to potential arbitrary code execution in the context of the FreeType2 library client. It will require a CVE identifier and most likely a new stable library release.

I would like to ask you to keep the bug private until a new release is out.

Report:

==31664==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff76853d70 at pc 0x6d2d74 bp 0x7fff768537f0 sp 0x7fff768537e8
READ of size 1 at 0x7fff76853d70 thread T0
    #0 0x6d2d73 in cf2_hintmap_build freetype2/src/cff/cf2hints.c:820
    #1 0x6b85ab in cf2_interpT2CharString freetype2/src/cff/cf2intrp.c:1201
    #2 0x6ae390 in cf2_getGlyphOutline freetype2/src/cff/cf2font.c:461
    #3 0x6aafa6 in cf2_decoder_parse_charstrings freetype2/src/cff/cf2ft.c:369
    #4 0x6a134c in cff_slot_load freetype2/src/cff/cffgload.c:2840
    #5 0x66b8b0 in cff_glyph_load freetype2/src/cff/cffdrivr.c:185
    #6 0x4a28e2 in FT_Load_Glyph freetype2/src/base/ftobjs.c:726
    #7 0x492475 in test_load freetype2-demos/src/ftbench.c:249
    #8 0x4930e7 in benchmark freetype2-demos/src/ftbench.c:216
    #9 0x48f692 in main freetype2-demos/src/ftbench.c:1020

Address 0x7fff76853d70 is located in stack of thread T0 at offset 304 in frame
    #0 0x6d1c8f in cf2_hintmap_build freetype2/src/cff/cf2hints.c:754

  This frame has 20 object(s):
    [32, 40) 'hintmap.addr'
    [64, 72) 'hStemHintArray.addr'
    [96, 104) 'vStemHintArray.addr'
    [128, 136) 'hintMask.addr'
    [160, 164) 'hintOrigin.addr'
    [176, 177) 'initialMap.addr'
    [192, 200) 'maskPtr'
    [224, 232) 'font'
    [256, 304) 'tempHintMask' <== Memory access at offset 304 overflows this variable
    [336, 344) 'bitCount'
    [368, 376) 'i'
    [400, 401) 'maskByte'
    [416, 448) 'dummy'
    [480, 512) 'bottomHintEdge'
    [544, 576) 'topHintEdge'
    [608, 640) 'edge62'
    [672, 704) 'invalid'
    [736, 768) 'bottomHintEdge77'
    [800, 832) 'topHintEdge78'
    [864, 872) 'stemhint'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow freetype2/src/cff/cf2hints.c:820 cf2_hintmap_build
Shadow bytes around the buggy address:
  0x10006ed02750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006ed02760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006ed02770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006ed02780: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
  0x10006ed02790: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 04 f2 01 f2
=>0x10006ed027a0: 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 00[f2]f2
  0x10006ed027b0: f2 f2 00 f2 f2 f2 00 f2 f2 f2 01 f2 00 00 00 00
  0x10006ed027c0: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x10006ed027d0: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x10006ed027e0: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x10006ed027f0: f2 f2 f2 f2 00 f3 f3 f3 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      [31==31664==ABORTING


Root cause: no implementation for the "TODO" comment below.

--- src/cff/cf2hints.c ---
794:    /* use the hStem hints only, which are first in the mask */
795:    /* TODO: compare this to cffhintmaskGetBitCount */
796:    bitCount = cf2_arrstack_size( hStemHintArray );
--- cut ---