The FreeType Project - Bugs: bug #43655, FreeType 2.5.3 Type42 parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43655: FreeType 2.5.3 Type42 parsing out-of-bounds read in "ps_table_add"
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Fri 21 Nov 2014 11:28:46 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Mon 24 Nov 2014 06:31:03 AM UTC, comment #3: |
Werner LEMBERG <wl> |
Sun 23 Nov 2014 01:06:11 PM UTC, comment #2: I think I can still reproduce the problem (with a new set of samples, attached):
|
Mateusz Jurczyk <j00ru> |
Fri 21 Nov 2014 09:20:44 PM UTC, comment #1: Fixed in git. Thanks for the report! |
Werner LEMBERG <wl> |
Fri 21 Nov 2014 11:28:46 AM UTC, original submission:
The following heap-based out-of-bounds memory read has been encountered in FreeType while fuzzing Type42 fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 11 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-11-23 | j00ru | Attached File | - | Added asan_heap-oob_a9d7bc_2348_cov_2007884128_Tragic2.t42, #32526 | |
Attached File | - | Added asan_heap-oob_a9d7bc_3307_cov_2739484000_bocumaad.t42, #32527 | |||
Attached File | - | Added asan_heap-oob_a9d7bc_2603_aesymatt.t42, #32528 | |||
2014-11-22 | wl | Assigned to | None | wl | |
2014-11-21 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 | |||
2014-11-21 | j00ru | Attached File | - | Added asan_heap-oob_a767ee_2737_cov_3928323887_aspartam.t42, #32496 | |
Attached File | - | Added asan_heap-oob_a767ee_5407_cov_532226128_ecliptic.t42, #32497 | |||
Attached File | - | Added asan_heap-oob_a767ee_3271_cov_3357614757_bobcaygr.t42, #32498 |
Powered by Savane 3.13-f8d8.
Corresponding source code
Should now be really fixed :-) Thanks again.