The FreeType Project - Bugs: bug #46252, Enormous (144TB, arbitrary)...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46252: Enormous (144TB, arbitrary) allocation in cid_read_subrs.
Submitter: | bungeman <bungeman> | ||
Submitted: | Mon 19 Oct 2015 08:59:42 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Incorrect behaviour |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.6.2 |
Tue 20 Oct 2015 08:36:35 PM UTC, comment #3: |
Werner LEMBERG <wl> |
Mon 19 Oct 2015 09:38:07 PM UTC, comment #2: Note that I'm currently working around this killing the fuzzer workers by replacing the TODO comment below with
|
bungeman <bungeman> |
Mon 19 Oct 2015 09:10:02 PM UTC, comment #1: It seems this needs to at least ensure that 'data_len' bytes actually exist in the stream before making the allocation. In other words, something like
|
bungeman <bungeman> |
Mon 19 Oct 2015 08:59:42 PM UTC, original submission:
Found with libFuzzer+AddressSanitizer, reproduction attached.
|
bungeman <bungeman> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-10-20 | wl | Status | None | Fixed | |
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.6.2 | |||
2015-10-19 | bungeman | Attached File | - | Added crash-ee28578063fc2167017855b7c5c4606e996b7e02, #35231 |
Powered by Savane 3.13-758e.
Corresponding source code
Fixed differently with commit 3eccc3a3. Thanks for the report!