bugThe FreeType Project - Bugs: bug #45661, invalid shift and memory access...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45661: invalid shift and memory access within misaligned address

Submitter:  Dingbao Xie <xiedingbao>
Submitted:  Thu 30 Jul 2015 08:56:31 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Thu 11 Feb 2016 06:47:32 AM UTC, comment #5: 

I no longer get any clang errors with current git (now testing on 64bit) thus I'm closing this bug report.

Werner LEMBERG <wl>
Group administrator
Tue 04 Aug 2015 03:15:21 PM UTC, comment #4: 

I do not know where I get wrong ideas.

Alexei Podtelezhnikov <podtelez>
Group Member
Tue 04 Aug 2015 04:14:19 AM UTC, comment #3: 


> The signed left shifts are defined when the result fits
> and undefined when it does not.


This is not correct.  From http://c0x.coding-guidelines.com/6.5.7.html:

  1192 If E1 has a signed type and nonnegative value, and E1 × 2^E2 is representable in the result type, then that is the resulting value;

  1193 otherwise, the behavior is undefined.

In other words, left-shifting a negative value is always undefined.

I think that checking for overflow before the multiplication is overkill.  If you find an important place where you think such a check is necessary, please report it to the list.

Werner LEMBERG <wl>
Group administrator
Mon 03 Aug 2015 05:53:18 PM UTC, comment #2: 

Replacing left-shifts with multiplications only removes the waring. The signed left shifts are defined when the result fits and undefined when it does not. The replacement with multiplication can still overflow in an undefined manner. So the real fix should involve checking the range of values to be shifted or multiplied.

Alexei Podtelezhnikov <podtelez>
Group Member
Sat 01 Aug 2015 07:24:16 AM UTC, comment #1: 

Thanks for the report.  I'v fixed some left-shift issues in the git repository.  However, I don't have a 64bit machine so I don't see the alignment problem, unfortunately.

Any chance that you can have a closer look, probably providing a fix?

Werner LEMBERG <wl>
Group administrator
Thu 30 Jul 2015 08:56:31 PM UTC, original submission:  

I found several undefined behavior in freetype-2.6 with afl-fuzzer.
To reproduce them, you need to build the source code with flag '-fsanitize=undefined'.  Then compile the example code using cmd
clang -fsanitize=undefined example1.c -I ../local/include/freetype2/ ../local/lib/libfreetype.a -lz -lpng -lharfbuzz'.
After that execute cmd './example1 $font_file  text/test', you will see the following error information:
freetype-2.6/src/base/ftobjs.c:2896:27: runtime error: member access within misaligned address 0x732f6e6f6d6d6f63 for type 'struct FT_DriverRec_', which requires 8 byte alignment
freetype-2.6/src/base/ftobjs.c:2896:19: runtime error: member access within misaligned address 0x000000e3b8ad for type 'struct FT_FaceRec_', which requires 8 byte alignment
freetype-2.6/src/truetype/ttgload.c:671:43: runtime error: left shift of negative value -16384
/freetype-2.6/src/truetype/ttgload.c:659:43: runtime error: left shift of negative value -16384


Dingbao Xie <xiedingbao>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #34558:  example1.c added by xiedingbao (4KiB - text/x-csrc)
file #34559:  malformed_font.zip added by xiedingbao (1MiB - application/zip)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by xiedingbao (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-02-11 wl StatusNeed Info Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-08-01 wl StatusNone Need Info
        Assigned toNone wl
    2015-07-30 xiedingbao Attached File- Added example1.c, #34558
        Attached File- Added malformed_font.zip, #34559

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code