The FreeType Project - Bugs: bug #43660, FreeType 2.5.3 BDF parsing NULL...

Group

Main
- Main
- View members
- Search
Homepage
Download
Mailing lists
Source code
- Use CVS
- Browse CVS repository
- Browse Web Pages Repository
- Use Git
- Browse Git repositories
- freetype
- The FreeType 2 demo programs
- The FreeType 2 library
Bugs
Patches

You are not allowed to post comments on this tracker with your current authentication level.

bug #43660: FreeType 2.5.3 BDF parsing NULL pointer dereference in "_bdf_parse_glyphs"

Submitter:	Mateusz Jurczyk <j00ru>
Submitted:	Fri 21 Nov 2014 11:40:10 AM UTC


Severity:	3 - Normal	Item Group:	Crash
Status:	Fixed	Privacy:	Public
Assigned to:	wl	Open/Closed:	Closed
Planned Release:	2.5.4

Sat 22 Nov 2014 12:30:27 PM UTC, comment #1:

Fixed in git. Thanks for the report!

Werner LEMBERG <wl>

Fri 21 Nov 2014 11:40:10 AM UTC, original submission:

The following NULL pointer dereference crash has been encountered in FreeType while fuzzing BDF fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are two POC files which trigger the condition.

ASAN:SIGSEGV
=================================================================
==8204==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000084e7af sp 0x7fffb35ceba0 bp 0x7fffb35cffb0 T0)
    #0 0x84e7ae in _bdf_parse_glyphs freetype2/src/bdf/bdflib.c:1789
    #1 0x82cf2b in _bdf_readstream freetype2/src/bdf/bdflib.c:787
    #2 0x820895 in bdf_load_font freetype2/src/bdf/bdflib.c:2404
    #3 0x813c7a in BDF_Face_Init freetype2/src/bdf/bdfdrivr.c:364
    #4 0x4cc13e in open_face freetype2/src/base/ftobjs.c:1191
    #5 0x4c794b in FT_Open_Face freetype2/src/base/ftobjs.c:2123
    #6 0x4c5b58 in FT_New_Face freetype2/src/base/ftobjs.c:1254
    #7 0x491533 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #8 0x48d748 in main ft2demos-2.5.3/src/ftbench.c:924

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV freetype2/src/bdf/bdflib.c:1789 _bdf_parse_glyphs
==8204==ABORTING

Mateusz Jurczyk <j00ru>

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

file #32507: signal_sigsegv_83a1e9_6723_cov_1443223462_helvB12-ISO8859-1-17.bdf added by j00ru (24KiB - application/octet-stream)

file #32508: signal_sigsegv_83a1e9_8269_cov_107630157_lutBS14-ISO8859-1-20.bdf added by j00ru (27KiB - application/octet-stream)

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by wl (Posted a comment)

-email is unavailable- added by j00ru (Submitted the item)

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Follow 7 latest changes.

Date	Changed by	Updated Field	Previous Value	Replaced by
2014-11-22	wl	Status	None	Fixed
		Privacy	Private	Public
		Assigned to	None	wl
		Open/Closed	Open	Closed
		Planned Release	None	2.5.4
2014-11-21	j00ru	Attached File	-	Added signal_sigsegv_83a1e9_6723_cov_1443223462_helvB12-ISO8859-1-17.bdf, #32507
		Attached File	-	Added signal_sigsegv_83a1e9_8269_cov_107630157_lutBS14-ISO8859-1-20.bdf, #32508

The FreeType Project - Bugs: bug #43660, FreeType 2.5.3 BDF parsing NULL...

bug #43660: FreeType 2.5.3 BDF parsing NULL pointer dereference in "_bdf_parse_glyphs"

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#votes">Votes</a>

<a href="#history">History</a>