bugThe FreeType Project - Bugs: bug #30306, SIGSEGV in FT_Stream_ReadAt():145...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30306: SIGSEGV in FT_Stream_ReadAt():145 ; invalid parameters to memcpy() - mac font parsing routines

Submitter:  Robert Swiecki <jagger>
Submitted:  Wed 30 Jun 2010 03:49:03 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  mpsuzuki Open/Closed:  Closed
Planned Release:  2.3.13

Jump to the original submission

Fri 02 Jul 2010 09:06:37 AM UTC, comment #6: 

Oh, I see. Thank you very much,
I'm happy to know that I don't have to invent
a recoverying method for the font files.

suzuki toshiya <mpsuzuki>
Group administrator
Fri 02 Jul 2010 08:54:48 AM UTC, comment #5: 

Nah.. this font is an effect of so-called input fuzzing, and has deliberately invalid structure so, no, I don't expect any other platform to be able to parse it :)

Robert Swiecki <jagger>
Fri 02 Jul 2010 08:50:22 AM UTC, comment #4: 

According to Adobe Technical Note 5040, font driver should not
load the segment whose flag is set to 0x00, because it is the
segment for comment (thus, the producer of sigsegv27.ttf may
think the length is not needed to be exact...?).

Anyway, SEGV issue is fixed, but FT2 could not parse a usable
face from loaded PFB image. I tried to make Mac OS X validate
the fonts (sigsegv26.ttf and sigsegv27.ttf), but I could not.
At least, PFB image included in sigsegv26.ttf seems to be broken.
In it, a list of font names is broken, a few bytes are replaced by
binary bytes. Like...

dup 123 /bullet put
dup 124 /H9284 put
dup 12\036 /H11008 put
dup 126 /H20849 put

Oh, 12\036 might be broken 125.

jagger, if you know any platform that recognize sample font files
correctly, please let me know.

(file #20878)

suzuki toshiya <mpsuzuki>
Group administrator
Fri 02 Jul 2010 12:19:36 AM UTC, comment #3: 

Looks like it's been fixed. Thanks.

Robert Swiecki <jagger>
Thu 01 Jul 2010 09:36:05 AM UTC, comment #2: 

The case of sigsegv27.ttf is slightly different,
its rlen is 0xFFFFFFFF and flag is 0x0000.
Umm, the comparison of rlen vs whole font file
size would be expected.

suzuki toshiya <mpsuzuki>
Group administrator
Thu 01 Jul 2010 09:22:34 AM UTC, comment #1: 

The SEGV is caused by an overlooked case about
odd-sized fragment of POST resource. sigsegv26.ttf
includes 13 fragments of PFA, the last fragment
is zero-sized. Current FT2 expects any fragment
is longer than 16-bit, and calculate the size aslike:


  1543        error = FT_Stream_Seek( stream, offsets[i] );
  1544        if ( error )
  1545          goto Exit2;
  1546        if ( FT_READ_LONG( rlen ) )
  1547          goto Exit;
  1548        if ( FT_READ_USHORT( flags ) )
  1549          goto Exit;
  1550        rlen -= 2;                    /* the flags are part of the resource */

In sigsegv26.ttf, the final fragment sets rlen to 0, and
"rlen -= 2" causes underflow for unsigned long value.
It makes FT_Stream_Read() failed, because rlen is almost
about ULONG_MAX.

For first, I will insert "rlen" check to prevent this underflow
(soon), then try to fix to load the font correctly.

suzuki toshiya <mpsuzuki>
Group administrator
Wed 30 Jun 2010 03:49:03 PM UTC, original submission:  

gcc version 4.4.3 on Linux amd64, compiled with "-O0 -g"

Fonts: http://alt.swiecki.net/j/f/sigsegv26.ttf http://alt.swiecki.net/j/f/sigsegv27.ttf

$ gdb ./ftbench

(gdb) r -c 1 sigsegv26.ttf
Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:433
433 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S

(gdb) up
#1  0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
145       FT_MEM_COPY( buffer, stream->base + pos, read_bytes );

(gdb) p buffer
$4 = (FT_Byte *) 0x6b2f2b "\377\377\377"
(gdb) p buffer + read_bytes - 1
$5 = (FT_Byte *) 0x6e3ec1 <Address 0x6e3ec1 out of bounds>


(gdb) bt
#0  memcpy () at ../sysdeps/x86_64/memcpy.S:433
#1  0x000000000040ecfb in FT_Stream_ReadAt (stream=0x6ada00, pos=21818, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2  0x000000000040ec45 in FT_Stream_Read (stream=0x6ada00, buffer=0x6b2f2b "\377\377\377", count=18446744073709551614) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3  0x000000000040776a in Mac_Read_POST_Resource (library=0x6a8040, stream=0x6ada00, offsets=0x6adb40, resource_cnt=13, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
#4  0x0000000000407b13 in IsMacResource (library=0x6a8040, stream=0x6ada00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
#5  0x0000000000407d86 in IsMacBinary (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
#6  0x0000000000407fbe in load_mac_face (library=0x6a8040, stream=0x6ada00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
#7  0x00000000004083d4 in FT_Open_Face (library=0x6a8040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
#8  0x0000000000406e2c in FT_New_Face (library=0x6a8040, pathname=0x7fffffffe993 "sigsegv26.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#9  0x0000000000402b30 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#10 0x0000000000402e9f in main (argc=1, argv=0x7fffffffe670) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739



==32065== Memcheck, a memory error detector
==32065== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32065== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==32065== Command: ./ftbench -c 1 sigsegv26.ttf
==32065==
==32065== Invalid write of size 1
==32065==    at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065==  Address 0x540be81 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065==    at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065==  Address 0x540be80 is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065==    at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065==  Address 0x540be7f is not stack'd, malloc'd or (recently) free'd
==32065==
==32065== Invalid write of size 1
==32065==    at 0x4C2AA11: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==32065==    by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==32065==    by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==32065==    by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==32065==    by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==32065==    by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==32065==    by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==32065==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==32065==  Address 0x540be7e is not stack'd, malloc'd or (recently) free'd
==32065==

valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 18446744073709486080, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.

==32065==    at 0x3802CA47: report_and_quit /tmp/vg/coregrind/m_libcassert.c:191
==32065==    by 0x3802CC73: vgPlain_assert_fail /tmp/vg/coregrind/m_libcassert.c:265
==32065==    by 0x3803800B: vgPlain_arena_malloc /tmp/vg/coregrind/m_mallocfree.c:246
==32065==    by 0x38002DD4: vgMemCheck_new_block /tmp/vg/memcheck/mc_malloc_wrappers.c:199
==32065==    by 0x380031D9: vgMemCheck_malloc /tmp/vg/memcheck/mc_malloc_wrappers.c:236
==32065==    by 0x3806872E: vgPlain_scheduler /tmp/vg/coregrind/m_scheduler/scheduler.c:1384
==32065==    by 0x3808EA10: run_a_thread_NORETURN /tmp/vg/coregrind/m_syswrap/syswrap-linux.c:94

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==32065==    at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==32065==    by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==32065==    by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==32065==    by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==32065==    by 0x40E7C9: raccess_make_file_name /usr/local/google/src/freetype2/src/base/ftrfork.c:764
==32065==    by 0x40E11E: raccess_guess_darwin_ufs_export /usr/local/google/src/freetype2/src/base/ftrfork.c:454
==32065==    by 0x40DFF6: FT_Raccess_Guess /usr/local/google/src/freetype2/src/base/ftrfork.c:387
==32065==    by 0x407E37: load_face_in_embedded_rfork /usr/local/google/src/freetype2/src/base/ftobjs.c:1808
==32065==    by 0x40803F: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1899
==32065==    by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==32065==    by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==32065==    by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==32065==    by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739


Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using.  Thanks.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #20860:  sigsegv26.ttf added by jagger (217KiB - application/x-font-ttf)
file #20861:  sigsegv27.ttf added by jagger (240KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mpsuzuki (Updated the item)
  • -email is unavailable- added by jagger (Submitted the item)
  • -email is unavailable- added by jagger
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-07-02 mpsuzuki Attached File- Added fix-savannah-30306-pt2.diff, #20878
        StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.13
    2010-07-01 mpsuzuki StatusConfirmed In Progress
    2010-07-01 mpsuzuki StatusNone Confirmed
    2010-06-30 mpsuzuki Assigned toNone mpsuzuki
    2010-06-30 jagger Attached File- Added sigsegv26.ttf, #20860
        Attached File- Added sigsegv27.ttf, #20861
        Carbon-Copy- Added mpsuzuki

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code