bugThe FreeType Project - Bugs: bug #30083, SIGSEGV while loading a glyph...

 
 

bug #30083: SIGSEGV while loading a glyph (index 49)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Tue 08 Jun 2010 03:21:35 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 11 Jun 2010 06:14:36 AM UTC, comment #4:

Thanks for testing.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 10 Jun 2010 05:49:15 PM UTC, comment #3:

Yup, it was fixed in http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d3d2cc4fef72c6be9c454b3809c387e12b44cfc

It was buffer overflow in cff_decoder_parse_charstrings but now it's gone

(gdb) watch *0x7fffffffba10 == 0x00060000
Hardware watchpoint 1: *0x7fffffffba10 == 0x00060000
(gdb) r -m ABCDEFGHIJKLMNOPQRSTUVXYZ0123456789 20 sigsegv5.ttf
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/fuzz/ttf/ftstring -m ABCDEFGHIJKLMNOPQRSTUVXYZ0123456789 20 sigsegv5.ttf
Hardware watchpoint 1: *0x7fffffffba10 == 0x00060000

Old value = 0
New value = 1
0x0000000000437678 in cff_decoder_parse_charstrings (decoder=0x7fffffffba50,
charstring_base=0x7ffff7e90c27 "\177\n\367a\373h\367\a\371+\305\001\301\367@\367\330\367@\003\372>\373\024\025\217\226\203\251\206\225\b\201u[\201d\033Yj\226\266\065\037[\243[\244j\225\277\241\273\251\252\260\b\271\301\242\325\333\032\367\064%\367+\373n%\373\tf*B\036eUyIE\032+\253%\351K\036\264n\277{\307~\236\207\255~\243z\304c\305Y\312h\bt\265\271\201\255\033\300\362\237\313\323\037\374\317\371J\025\367%\261\373\065\373\024\373\034_&C\373+R\367\033\367\062\367\035\264\353\357\037\016\227\035\016\212\n\016\204\n\016\370+\035\273\001\371w\n\367\317\367;\003@\035\016\367\003\225v\370ะป\022{\371q\373O\367O\023\340}\370\303\025\236\207\227"..., charstring_len=2)
at /usr/local/src/freetype2/src/cff/cffgload.c:994
warning: Source file is more recent than executable.
994 *decoder->top++ = val;

Robert Swiecki <jagger>
Wed 09 Jun 2010 07:22:28 AM UTC, comment #2:

I don't get this; however, I've already fixed #30082, maybe this makes the difference. Please check. Otherwise I would be glad if you could dig into this problem.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 08 Jun 2010 03:33:07 PM UTC, comment #1:

Btw.. it crashes firefox as well..

$ LD_PRELOAD=/usr/local/src/freetype2/objs/.libs/libfreetype.so.6.4.0 LD_LIBRARY_PATH=/usr/lib/firefox-3.6.3/ /usr/lib/firefox-3.6.3/firefox-bin http://alt.swiecki.net/j/f.php?id=sigsegv5
Segmentation fault

Bogus values of rip and rbp looks, at the first glance, as a buffer overflow to me.

Robert Swiecki <jagger>
Tue 08 Jun 2010 03:21:35 PM UTC, original submission:

git sources as of 2010-06-08
Linux amd64
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)

Font: http://alt.swiecki.net/j/sigsegv5.ttf

The glyph index is 49

After setting breakpoint on FT_Load_Glyph and a few continue commands

Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=48, load_flags=512) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
562 FT_Bool autohint = FALSE;
(gdb)
Continuing.

Breakpoint 1, FT_Load_Glyph (face=0x6ec620, glyph_index=49, load_flags=516) at /usr/local/google/src/freetype2/src/base/ftobjs.c:562
562 FT_Bool autohint = FALSE;
(gdb)
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000060000 in ?? ()

(gdb) info registers
rax 0x81 129
rbx 0x31 49
rcx 0x10000 65536
rdx 0x7fffffffd4e8 140737488344296
rsi 0x4 4
rdi 0x6f2258 7283288
rbp 0x60000 0x60000
rsp 0x7fffffffd4d0 0x7fffffffd4d0
r8 0x6cc0e0 7127264
r9 0x6cc0e0 7127264
r10 0x0 0
r11 0x7ffff7310036 140737340571702
r12 0x401fa0 4202400
r13 0x7fffffffe3c0 140737488348096
r14 0x0 0
r15 0x0 0
rip 0x60000 0x60000
eflags 0x10206 [ PF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0

(gdb) bt
#0 0x0000000000060000 in ?? ()
#1 0x0000000000070000 in ?? ()

The rbp and rip registers are smashed, so no useful stacktrace here. Let me know if you want me to provide more detailed analysis.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 11 Jun 2010 06:14:36 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Wed 09 Jun 2010 07:22:28 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl

    Back to the top


    Powered by Savane 3.1-cleanup