The FreeType Project - Bugs: bug #46345, FreeType 2.6.1 TrueType parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46345: FreeType 2.6.1 TrueType parsing NULL pointer dereference in "tt_sbit_decoder_load_bit_aligned"
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Sat 31 Oct 2015 10:55:34 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.6.2 |
Tue 03 Nov 2015 04:31:52 PM UTC, comment #4: |
Werner LEMBERG <wl> |
Mon 02 Nov 2015 10:42:08 AM UTC, comment #3: Hmmm... the other one fails to upload for some reason, but I think one should be sufficient. |
Mateusz Jurczyk <j00ru> |
Mon 02 Nov 2015 10:40:46 AM UTC, comment #2: Whoops! Attached two testcases. |
Mateusz Jurczyk <j00ru> |
Sat 31 Oct 2015 04:56:56 PM UTC, comment #1: No attachment :-) |
Werner LEMBERG <wl> |
Sat 31 Oct 2015 10:55:34 AM UTC, original submission:
The following infinite recursion crash has been encountered in FreeType while fuzzing TrueType fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-11-03 | wl | Status | Need Info | Fixed | |
Privacy | Private | Public | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.6.2 | |||
2015-11-02 | j00ru | Attached File | - | Added signal_sigsegv_7833bc_9078_fbc901829860625e3d156fced50cd1c0, #35363 | |
2015-10-31 | wl | Status | None | Need Info | |
Assigned to | None | wl |
Powered by Savane 3.13-4448.
Corresponding source code
Fixed in git, thanks.