bugThe FreeType Project - Bugs: bug #54242, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54242: heap-buffer-overflow in tt_face_load_cpal()

Submitter:  Tyson Smith <twsmith>
Submitted:  Tue 03 Jul 2018 09:35:56 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.10.0

Sat 07 Jul 2018 01:05:24 AM UTC, comment #2: 

Verified fixed with commit b532d7ce708cb5ca9bf88abaa2eb213ddcf9babb.

Tyson Smith <twsmith>
Thu 05 Jul 2018 09:06:47 PM UTC, comment #1: 

Fixed in git.  Thanks for the report, and please test.

Werner LEMBERG <wl>
Group administrator
Tue 03 Jul 2018 09:35:56 PM UTC, original submission:  

Tested with git revision d9d300ab6bd8895b9247213ac87b26cc76a3fc5d

==21929==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000560 at pc 0x000000630f40 bp 0x7fff48c3db70 sp 0x7fff48c3db68
READ of size 1 at 0x61a000000560 thread T0
    #0 0x630f3f in tt_face_load_cpal src/sfnt/ttcpal.c:138:28
    #1 0x61dd25 in sfnt_load_face src/sfnt/sfobjs.c:1347:7
    #2 0x5d7953 in cff_face_init src/cff/cffobjs.c:566:17
    #3 0x55755e in open_face src/base/ftobjs.c:1375:15
    #4 0x528309 in ft_open_face_internal src/base/ftobjs.c:2447:19
    #5 0x52a281 in FT_New_Memory_Face src/base/ftobjs.c:1465:12
    #6 0x510a25 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:314:16
    #7 0x511e13 in main src/tools/ftfuzzer/ftfuzzer.cc:454:9
    #8 0x7f9a7f15382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x41a388 in _start (/home/ubuntu/build/build/ftfuzzer+0x41a388)

0x61a000000560 is located 0 bytes to the right of 1248-byte region [0x61a000000080,0x61a000000560)
allocated by thread T0 here:
    #0 0x4d2a08 in __interceptor_malloc (ftfuzzer+0x4d2a08)
    #1 0x511dce in main src/tools/ftfuzzer/ftfuzzer.cc:451:45

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44502:  testcase.ttf added by twsmith (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by twsmith (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-07-05 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.0
    2018-07-03 twsmith Attached File- Added testcase.ttf, #44502

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code