bugThe FreeType Project - Bugs: bug #30644, Bad CFF font file causes crash

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30644: Bad CFF font file causes crash

Submitter:  Chris Evans <scarybeasts>
Submitted:  Wed 04 Aug 2010 03:21:02 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.2

Jump to the original submission

Tue 17 Jul 2012 12:00:26 PM UTC, comment #7: 

I think werner lemberg expert in bug #30644.

<a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Raksha Bandhan SMS</a> | <a href="http://www.fullonsms.com/raksha-bandhan-sms.php">Rakhi SMS</a> | <a href="http://www.fullonsms.com/friendship-day-sms.php">Friendship Day SMS </a> | <a href="http://www.fullonsms.com/independence-day-sms.php">Independence Day SMS</a> | <a href="http://www.fullonsms.com/eid-mubarak-sms.php">Eid SMS</a>

Shaun Marsh <jack12>
Wed 04 Aug 2010 11:53:58 PM UTC, comment #6: 

Werner is awesome :)

When 2.4.2 comes out, I'm pretty inspired to do some more fuzzing.

Chris Evans <scarybeasts>
Wed 04 Aug 2010 02:19:25 PM UTC, comment #5: 

Aah, the crash is caused by a function in a part of FreeType which is disabled by `make devel'.  I could reproduce it now, and it should be fixed in the git repository.  Thanks!

Werner LEMBERG <wl>
Group administrator
Wed 04 Aug 2010 12:46:50 PM UTC, comment #4: 

Yeah.. it crashes only 64bit version for me as well (I have quite new sources from the svn)

$ gdb ./ftbench
(gdb) r -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf

Program received signal SIGSEGV, Segmentation fault.
0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
207         *cur = FT_NEXT_SHORT( p );
(gdb) bt
#0  0x000000000044e8e8 in tt_face_load_hmtx (face=0x6aca60, stream=0x6aca00, vertical=0 '\000') at /usr/local/google/src/freetype2/src/sfnt/ttmtx.c:207
#1  0x00000000004560e1 in sfnt_load_face (stream=0x6aca00, face=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/sfnt/sfobjs.c:630
#2  0x0000000000430890 in cff_face_init (stream=0x6aca00, cffface=0x6aca60, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/cff/cffobjs.c:495
#3  0x00000000004063ed in open_face (driver=0x6abca0, stream=0x6aca00, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe368) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#4  0x0000000000407a20 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe3e0, face_index=0, aface=0x7fffffffe500) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2041
#5  0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe93d "SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf", face_index=0, aface=0x7fffffffe500)
    at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#6  0x0000000000402319 in get_face (face=0x7fffffffe500) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#7  0x0000000000402603 in main (argc=1, argv=0x7fffffffe620) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740


$ valgrind ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax\,_byte_\[rax\].ttf
==32181== Memcheck, a memory error detector
==32181== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==32181== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==32181== Command: ./ftbench -c 1 SIGSEGV.PC.0x44e8e8.CODE.1.ADDR.0x7ffff7fff000.INSTR.movzx_eax,_byte_[rax].ttf
==32181==
==32181== Invalid read of size 1
==32181==    at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181==    by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181==    by 0x43088F: cff_face_init (cffobjs.c:495)
==32181==    by 0x4063EC: open_face (ftobjs.c:1134)
==32181==    by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181==    by 0x402318: get_face (ftbench.c:616)
==32181==    by 0x402602: main (ftbench.c:740)
==32181==  Address 0x402a000 is not stack'd, malloc'd or (recently) free'd
==32181==
==32181==
==32181== Process terminating with default action of signal 11 (SIGSEGV)
==32181==  Access not within mapped region at address 0x402A000
==32181==    at 0x44E8E8: tt_face_load_hmtx (ttmtx.c:207)
==32181==    by 0x4560E0: sfnt_load_face (sfobjs.c:630)
==32181==    by 0x43088F: cff_face_init (cffobjs.c:495)
==32181==    by 0x4063EC: open_face (ftobjs.c:1134)
==32181==    by 0x407A1F: FT_Open_Face (ftobjs.c:2041)
==32181==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==32181==    by 0x402318: get_face (ftbench.c:616)
==32181==    by 0x402602: main (ftbench.c:740)
==32181==  If you believe this happened as a result of a stack
==32181==  overflow in your program's main thread (unlikely but
==32181==  possible), you can try to increase the size of the
==32181==  main thread stack using the --main-stacksize= flag.
==32181==  The main thread stack size used in this run was 8388608.
==32181==
==32181== HEAP SUMMARY:
==32181==     in use at exit: 96,428 bytes in 46 blocks
==32181==   total heap usage: 52 allocs, 6 frees, 99,332 bytes allocated
==32181==
==32181== LEAK SUMMARY:
==32181==    definitely lost: 0 bytes in 0 blocks
==32181==    indirectly lost: 0 bytes in 0 blocks
==32181==      possibly lost: 0 bytes in 0 blocks
==32181==    still reachable: 96,428 bytes in 46 blocks
==32181==         suppressed: 0 bytes in 0 blocks
==32181== Rerun with --leak-check=full to see details of leaked memory
==32181==
==32181== For counts of detected and suppressed errors, rerun with: -v
==32181== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>
Wed 04 Aug 2010 07:50:32 AM UTC, comment #3: 

Indeed, it seems to be a 64-bit issue, and I have no access to such a machine, sorry.  Can you debug this?

Werner LEMBERG <wl>
Group administrator
Wed 04 Aug 2010 06:53:11 AM UTC, comment #2: 

Whoops, sorry about that.

I used:
ftbench -c 1 badotf.7

This is with a 64-bit build which can make all the difference with bugs like this. A guy from Apple also confirmed he sees a crash with this file (also 64-bit looking at the stack back trace he sent me).

Chris Evans <scarybeasts>
Wed 04 Aug 2010 06:49:43 AM UTC, comment #1: 

I need a recipe to reproduce the crash with one of the FreeType demo programs.  Calling ftview or ftbench from FreeType 2.4.1 under GNU/Linux works just fine for me, this is, the font is correctly rejected.  Valgrind doesn't show any problems either.

Werner LEMBERG <wl>
Group administrator
Wed 04 Aug 2010 03:21:02 AM UTC, original submission:  

FreeType 2.4.1 seems much more robust against bad font files but the attached CFF font still causes a crash. It doesn't look like a particularly serious crash at first glance. There's a wild pointer involved but it used as the basis of a read.

Chris Evans <scarybeasts>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #21135:  badotf.7 added by scarybeasts (30KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jack12 (Posted a comment)
  • -email is unavailable- added by jagger (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by scarybeasts (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-04 wl StatusNeed Info Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.2
    2010-08-04 wl Item GroupNone Crash
        StatusNone Need Info
        Assigned toNone wl
    2010-08-04 scarybeasts Attached File- Added badotf.7, #21135

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code