bugThe FreeType Project - Bugs: bug #30306, SIGSEGV in FT_Stream_ReadAt():145...

 
 

bug #30306: SIGSEGV in FT_Stream_ReadAt():145 ; invalid parameters to memcpy() - mac font parsing routines

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Wed 30 Jun 2010 03:49:03 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: suzuki toshiya <mpsuzuki>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 02 Jul 2010 09:06:37 AM UTC, comment #6:

Oh, I see. Thank you very much,
I'm happy to know that I don't have to invent
a recoverying method for the font files.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Fri 02 Jul 2010 08:54:48 AM UTC, comment #5:

Nah.. this font is an effect of so-called input fuzzing, and has deliberately invalid structure so, no, I don't expect any other platform to be able to parse it :)

Robert Swiecki <jagger>
Fri 02 Jul 2010 08:50:22 AM UTC, comment #4:

According to Adobe Technical Note 5040, font driver should not
load the segment whose flag is set to 0x00, because it is the
segment for comment (thus, the producer of sigsegv27.ttf may
think the length is not needed to be exact...?).

Anyway, SEGV issue is fixed, but FT2 could not parse a usable
face from loaded PFB image. I tried to make Mac OS X validate
the fonts (sigsegv26.ttf and sigsegv27.ttf), but I could not.
At least, PFB image included in sigsegv26.ttf seems to be broken.
In it, a list of font names is broken, a few bytes are replaced by
binary bytes. Like...

dup 123 /bullet put
dup 124 /H9284 put
dup 12\036 /H11008 put
dup 126 /H20849 put

Oh, 12\036 might be broken 125.

jagger, if you know any platform that recognize sample font files
correctly, please let me know.

(file #20878)

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Fri 02 Jul 2010 12:19:36 AM UTC, comment #3:

Looks like it's been fixed. Thanks.

Robert Swiecki <jagger>
Thu 01 Jul 2010 09:36:05 AM UTC, comment #2:

The case of sigsegv27.ttf is slightly different,
its rlen is 0xFFFFFFFF and flag is 0x0000.
Umm, the comparison of rlen vs whole font file
size would be expected.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Thu 01 Jul 2010 09:22:34 AM UTC, comment #1:

The SEGV is caused by an overlooked case about
odd-sized fragment of POST resource. sigsegv26.ttf
includes 13 fragments of PFA, the last fragment
is zero-sized. Current FT2 expects any fragment
is longer than 16-bit, and calculate the size aslike:

1543 error = FT_Stream_Seek( stream, offsets[i] );
1544 if ( error )
1545 goto Exit2;
1546 if ( FT_READ_LONG( rlen ) )
1547 goto Exit;
1548 if ( FT_READ_USHORT( flags ) )
1549 goto Exit;
1550 rlen -= 2; /* the flags are part of the resource */

In sigsegv26.ttf, the final fragment sets rlen to 0, and
"rlen -= 2" causes underflow for unsigned long value.
It makes FT_Stream_Read() failed, because rlen is almost
about ULONG_MAX.

For first, I will insert "rlen" check to prevent this underflow
(soon), then try to fix to load the font correctly.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Wed 30 Jun 2010 03:49:03 PM UTC, original submission:

gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"

Fonts: http://alt.swiecki.net/j/f/sigsegv26.ttf http://alt.swiecki.net/j/f/sigsegv27.ttf

$ gdb ./ftbench

(gdb) r -c 1 sigsegv26.ttf
Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:433
433 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S

(gdb) up
#1 0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
145 FT_MEM_COPY( buffer, stream->base + pos, read_bytes );

(gdb) p buffer
$4 = (FT_Byte *) 0x6b2f2b "\377\377\377"
(gdb) p buffer + read_bytes - 1
$5 = (FT_Byte *) 0x6e3ec1 <Address 0x6e3ec1 out of bounds>

(gdb) bt
#0 memcpy () at ../sysdeps/x86_64/memcpy.S:433
#1 0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2 0x000000000040ec45 in FT_Stream_Read (stream=0x6ada00, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3 0x000000000040776a in Mac_Read_POST_Resource (library=0x6a8040, stream=0x6ada00, offsets=0x6adb40, resource_cnt=13, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
#4 0x0000000000407b13 in IsMacResource (library=0x6a8040, stream=0x6ada00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
#5 0x0000000000407d86 in IsMacBinary (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
#6 0x0000000000407fbe in load_mac_face (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
#7 0x00000000004083d4 in FT_Open_Face (library=0x6a8040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
#8 0x0000000000406e2c in FT_New_Face (library=0x6a8040, pathname=0x7fffffffe993 "sigsegv26.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#9 0x0000000000402b30 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#10 0x0000000000402e9f in main (argc=1, argv=0x7fffffffe670) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739

==32065== Memcheck, a memory error detector
==32065== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32065== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==32065== Command: ./ftbench -c 1 sigsegv26.ttf
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be81 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be80 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be7f is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065== at 0x4C2AA11: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065== Address 0x540be7e is not stack'd, malloc'd or (recently) free'd
==32065==

valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 18446744073709486080, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.

==32065== at 0x3802CA47: report_and_quit /tmp/vg/coregrind/m_libcassert.c:191
==32065== by 0x3802CC73: vgPlain_assert_fail /tmp/vg/coregrind/m_libcassert.c:265
==32065== by 0x3803800B: vgPlain_arena_malloc /tmp/vg/coregrind/m_mallocfree.c:246
==32065== by 0x38002DD4: vgMemCheck_new_block /tmp/vg/memcheck/mc_malloc_wrappers.c:199
==32065== by 0x380031D9: vgMemCheck_malloc /tmp/vg/memcheck/mc_malloc_wrappers.c:236
==32065== by 0x3806872E: vgPlain_scheduler /tmp/vg/coregrind/m_scheduler/scheduler.c:1384
==32065== by 0x3808EA10: run_a_thread_NORETURN /tmp/vg/coregrind/m_syswrap/syswrap-linux.c:94

sched status:
running_tid=1

Thread 1: status = VgTs_Runnable
==32065== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==32065== by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==32065== by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==32065== by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==32065== by 0x40E7C9: raccess_make_file_name /usr/local/google/src/freetype2/src/base/ftrfork.c:764
==32065== by 0x40E11E: raccess_guess_darwin_ufs_export /usr/local/google/src/freetype2/src/base/ftrfork.c:454
==32065== by 0x40DFF6: FT_Raccess_Guess /usr/local/google/src/freetype2/src/base/ftrfork.c:387
==32065== by 0x407E37: load_face_in_embedded_rfork /usr/local/google/src/freetype2/src/base/ftobjs.c:1808
==32065== by 0x40803F: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1899
==32065== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739

Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: http://www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using. Thanks.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20860:  sigsegv26.ttf added by jagger (217kB - application/x-font-ttf)
file #20861:  sigsegv27.ttf added by jagger (240kB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mpsuzuki (Updated the item)
  • -unavailable- added by jagger (Submitted the item)
  • -unavailable- added by jagger
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 10 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 02 Jul 2010 08:50:22 AM UTCmpsuzukiAttached File-=>Added fix-savannah-30306-pt2.diff, #20878
      StatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Thu 01 Jul 2010 10:04:54 AM UTCmpsuzukiStatusConfirmed=>In Progress
    Thu 01 Jul 2010 03:38:03 AM UTCmpsuzukiStatusNone=>Confirmed
    Wed 30 Jun 2010 03:51:50 PM UTCmpsuzukiAssigned toNone=>mpsuzuki
    Wed 30 Jun 2010 03:49:04 PM UTCjaggerAttached File-=>Added sigsegv26.ttf, #20860
      Attached File-=>Added sigsegv27.ttf, #20861
      Carbon-Copy-=>Added mpsuzuki

    Back to the top


    Powered by Savane 3.1-cleanup