bugThe FreeType Project - Bugs: bug #54232, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54232: heap-buffer-overflow in tt_face_palette_set()

Submitter:  Tyson Smith <twsmith>
Submitted:  Mon 02 Jul 2018 05:54:17 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.10.0

Sat 07 Jul 2018 01:06:02 AM UTC, comment #2: 

Verified fixed with commit b532d7ce708cb5ca9bf88abaa2eb213ddcf9babb.

Tyson Smith <twsmith>
Thu 05 Jul 2018 09:10:45 PM UTC, comment #1: 

Seems to be fixed with commit 0767d5362fdc2d14de842b264f24a6cb91d45d55, too.  Please check this.

Werner LEMBERG <wl>
Group administrator
Mon 02 Jul 2018 05:54:17 PM UTC, original submission:  

Tested with git revision 396051daee490544322b6ca5964772ecbebeac52

==14925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a00000055e at pc 0x000000632a86 bp 0x7ffe6ad58d50 sp 0x7ffe6ad58d48
READ of size 1 at 0x61a00000055e thread T0
    #0 0x632a85 in tt_face_palette_set src/sfnt/ttcpal.c:282:18
    #1 0x630c01 in tt_face_load_cpal src/sfnt/ttcpal.c:214:5
    #2 0x61dd35 in sfnt_load_face src/sfnt/sfobjs.c:1347:7
    #3 0x5d7953 in cff_face_init src/cff/cffobjs.c:566:17
    #4 0x55756e in open_face src/base/ftobjs.c:1375:15
    #5 0x528319 in ft_open_face_internal src/base/ftobjs.c:2447:19
    #6 0x52a291 in FT_New_Memory_Face src/base/ftobjs.c:1465:12
    #7 0x510a25 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:314:16
    #8 0x511e13 in main src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:454:9
    #9 0x7fb0b952282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #10 0x41a388 in _start (ftfuzzer+0x41a388)

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44492:  testcase.ttf added by twsmith (1KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by twsmith (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-07-05 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.0
    2018-07-02 twsmith Attached File- Added testcase.ttf, #44492

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code