bugThe FreeType Project - Bugs: bug #43655, FreeType 2.5.3 Type42 parsing...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43655: FreeType 2.5.3 Type42 parsing out-of-bounds read in "ps_table_add"

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Fri 21 Nov 2014 11:28:46 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.5.4

Mon 24 Nov 2014 06:31:03 AM UTC, comment #3: 

Should now be really fixed :-)  Thanks again.

 Werner LEMBERG <wl>
Group administrator
Sun 23 Nov 2014 01:06:11 PM UTC, comment #2: 

I think I can still reproduce the problem (with a new set of samples, attached):

=================================================================
==3183==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62e00000aebc at pc 0xa9d7bc bp 0x7fff021aab30 sp 0x7fff021aab28
READ of size 3 at 0x62e00000aebc thread T0
    #0 0xa9d7bb in ps_table_add freetype2/src/psaux/psobjs.c:216
    #1 0x7d58b1 in t42_parse_charstrings freetype2/src/type42/t42parse.c:870
    #2 0x7ccea0 in t42_load_keyword freetype2/src/type42/t42parse.c:1006
    #3 0x7cb6e1 in t42_parse_dict freetype2/src/type42/t42parse.c:1153
    #4 0x7c5b72 in T42_Open_Face freetype2/src/type42/t42objs.c:63
    #5 0x7bb5db in T42_Face_Init freetype2/src/type42/t42objs.c:202
    #6 0x4cc13e in open_face freetype2/src/base/ftobjs.c:1191
    #7 0x4c794b in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #8 0x4c5b58 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #9 0x491533 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #10 0x48d748 in main ft2demos-2.5.3/src/ftbench.c:924

0x62e00000aebc is located 0 bytes to the right of 43708-byte region [0x62e000000400,0x62e00000aebc)
allocated by thread T0 here:
    #0 0x472081 in __interceptor_malloc (ft2demos-2.5.3/bin/ftbench+0x472081)
    #1 0xaf3a2f in ft_alloc freetype2/src/base/ftsystem.c:74
    #2 0x526b21 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
    #3 0x4aee0f in ft_mem_alloc freetype2/src/base/ftutil.c:55
    #4 0x7c8cc1 in t42_parser_init freetype2/src/type42/t42parse.c:206
    #5 0x7c59aa in T42_Open_Face freetype2/src/type42/t42objs.c:56
    #6 0x7bb5db in T42_Face_Init freetype2/src/type42/t42objs.c:202
    #7 0x4cc13e in open_face freetype2/src/base/ftobjs.c:1191
    #8 0x4c794b in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #9 0x4c5b58 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #10 0x491533 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #11 0x48d748 in main ft2demos-2.5.3/src/ftbench.c:924

SUMMARY: AddressSanitizer: heap-buffer-overflow freetype2/src/psaux/psobjs.c:216 ps_table_add
Shadow bytes around the buggy address:
  0x0c5c7fff9580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5c7fff9590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5c7fff95a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5c7fff95b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5c7fff95c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c5c7fff95d0: 00 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa
  0x0c5c7fff95e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c7fff95f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c7fff9600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c7fff9610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c7fff9620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==3183==ABORTING



(file #32526, file #32527, file #32528)

 Mateusz Jurczyk <j00ru>
Group Member
Fri 21 Nov 2014 09:20:44 PM UTC, comment #1: 

Fixed in git.  Thanks for the report!

 Werner LEMBERG <wl>
Group administrator
Fri 21 Nov 2014 11:28:46 AM UTC, original submission:  

The following heap-based out-of-bounds memory read has been encountered in FreeType while fuzzing Type42 fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are three POC files which trigger the condition.

=================================================================
==5849==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63000000e3bf at pc 0xa9c3ec bp 0x7fff3b0c6570 sp 0x7fff3b0c6568
READ of size 2 at 0x63000000e3bf thread T0
    #0 0xa9c3eb in ps_table_add freetype2/src/psaux/psobjs.c:216
    #1 0x7d4b41 in t42_parse_charstrings freetype2/src/type42/t42parse.c:871
    #2 0x7cc130 in t42_load_keyword freetype2/src/type42/t42parse.c:1007
    #3 0x7ca971 in t42_parse_dict freetype2/src/type42/t42parse.c:1154
    #4 0x7c4df8 in T42_Open_Face freetype2/src/type42/t42objs.c:57
    #5 0x7ba9ab in T42_Face_Init freetype2/src/type42/t42objs.c:196
    #6 0x4cc13e in open_face freetype2/src/base/ftobjs.c:1191
    #7 0x4c794b in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #8 0x4c5b58 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #9 0x491533 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #10 0x48d748 in main ft2demos-2.5.3/src/ftbench.c:924

0x63000000e3bf is located 0 bytes to the right of 57279-byte region [0x630000000400,0x63000000e3bf)
allocated by thread T0 here:
    #0 0x472081 in __interceptor_malloc (ft2demos-2.5.3/bin/ftbench+0x472081)
    #1 0xaf265f in ft_alloc freetype2/src/base/ftsystem.c:74
    #2 0x526b21 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
    #3 0x4aee0f in ft_mem_alloc freetype2/src/base/ftutil.c:55
    #4 0x7c7f51 in t42_parser_init freetype2/src/type42/t42parse.c:206
    #5 0x7c4c30 in T42_Open_Face freetype2/src/type42/t42objs.c:50
    #6 0x7ba9ab in T42_Face_Init freetype2/src/type42/t42objs.c:196
    #7 0x4cc13e in open_face freetype2/src/base/ftobjs.c:1191
    #8 0x4c794b in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #9 0x4c5b58 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #10 0x491533 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #11 0x48d748 in main ft2demos-2.5.3/src/ftbench.c:924

SUMMARY: AddressSanitizer: heap-buffer-overflow freetype2/src/psaux/psobjs.c:216 ps_table_add
Shadow bytes around the buggy address:
  0x0c607fff9c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c607fff9c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c607fff9c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c607fff9c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c607fff9c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c607fff9c70: 00 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa
  0x0c607fff9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c607fff9c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c607fff9ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c607fff9cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c607fff9cc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==5849==ABORTING

 Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #32526:  asan_heap-oob_a9d7bc_2348_cov_2007884128_Tragic2.t42 added by j00ru (38KiB - application/octet-stream)
file #32527:  asan_heap-oob_a9d7bc_3307_cov_2739484000_bocumaad.t42 added by j00ru (94KiB - application/octet-stream)
file #32528:  asan_heap-oob_a9d7bc_2603_aesymatt.t42 added by j00ru (43KiB - application/octet-stream)
file #32496:  asan_heap-oob_a767ee_2737_cov_3928323887_aspartam.t42 added by j00ru (56KiB - application/octet-stream)
file #32497:  asan_heap-oob_a767ee_5407_cov_532226128_ecliptic.t42 added by j00ru (35KiB - application/octet-stream)
file #32498:  asan_heap-oob_a767ee_3271_cov_3357614757_bobcaygr.t42 added by j00ru (31KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 11 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-11-23 j00ru Attached File- Added asan_heap-oob_a9d7bc_2348_cov_2007884128_Tragic2.t42, #32526
        Attached File- Added asan_heap-oob_a9d7bc_3307_cov_2739484000_bocumaad.t42, #32527
        Attached File- Added asan_heap-oob_a9d7bc_2603_aesymatt.t42, #32528
    2014-11-22 wl Assigned toNone wl
    2014-11-21 wl StatusNone Fixed
        PrivacyPrivate Public
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.5.4
    2014-11-21 j00ru Attached File- Added asan_heap-oob_a767ee_2737_cov_3928323887_aspartam.t42, #32496
        Attached File- Added asan_heap-oob_a767ee_5407_cov_532226128_ecliptic.t42, #32497
        Attached File- Added asan_heap-oob_a767ee_3271_cov_3357614757_bobcaygr.t42, #32498

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code