bugThe FreeType Project - Bugs: bug #54208, crash at null in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54208: crash at null in cff_blend_build_vector()

Submitter:  Tyson Smith <twsmith>
Submitted:  Sat 30 Jun 2018 01:45:07 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.10.0

Sat 07 Jul 2018 04:28:39 AM UTC, comment #3: 

Closing, thanks.

Werner LEMBERG <wl>
Group administrator
Sat 07 Jul 2018 01:04:05 AM UTC, comment #2: 

Verified fixed with commit b532d7ce708cb5ca9bf88abaa2eb213ddcf9babb.

Tyson Smith <twsmith>
Thu 05 Jul 2018 08:32:47 PM UTC, comment #1: 

This should be fixed now, please test.

Werner LEMBERG <wl>
Group administrator
Sat 30 Jun 2018 01:45:07 AM UTC, original submission:  

Tested with git revision 1fc776b5f14e2be6fa3d6573f5cd3fb88a7ae468

I was only able to reproduce the crash with a 32bit build.

==113083==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x0822a4fe bp 0xff81ff98 sp 0xff81fec0 T0)
==113083==The signal is caused by a READ memory access.
==113083==Hint: address points to the zero page.
    #0 0x822a4fd in cff_blend_build_vector src/cff/cffload.c:1500:19
    #1 0x832e126 in cf2_interpT2CharString src/psaux/psintrp.c:754:25
    #2 0x8312764 in cf2_getGlyphOutline src/psaux/psfont.c:527:7
    #3 0x8312764 in cf2_decoder_parse_charstrings src/psaux/psft.c:435
    #4 0x821ffea in cff_slot_load src/cff/cffgload.c:441:17
    #5 0x821ffea in cff_glyph_load src/cff/cffdrivr.c:193
    #6 0x815c773 in FT_Load_Glyph src/base/ftobjs.c:907:15
    #7 0x8159b00 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:398:18
    #8 0x815a3a6 in main src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:454:9
    #9 0xf7bdd636 in __libc_start_main /build/glibc-mUak1Y/glibc-2.23/csu/../csu/libc-start.c:291
    #10 0x8061861 in _start (ftfuzzer+0x8061861)

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44458:  testcase.ttf added by twsmith (4KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by twsmith (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-07-07 wl StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2018-07-05 wl StatusNone Ready For Test
        Assigned toNone wl
        Planned ReleaseNone 2.10.0
    2018-06-30 twsmith Attached File- Added testcase.ttf, #44458

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code