bugThe FreeType Project - Bugs: bug #30658, Crash - SIGSEGV (read) in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30658: Crash - SIGSEGV (read) in Mac_Read_POST_Resource->FT_Stream_Read->memcpy (in base/ftobjs.c:1616)

Submitter:  Robert Swiecki <jagger>
Submitted:  Thu 05 Aug 2010 01:46:39 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  mpsuzuki Open/Closed:  Closed
Planned Release:  2.4.2

Fri 06 Aug 2010 04:55:17 PM UTC, comment #5: 

Thank you! Here I close this issue.

suzuki toshiya <mpsuzuki>
Group administrator
Fri 06 Aug 2010 03:37:49 PM UTC, comment #4: 

Yup, looks good. Thanks

Robert Swiecki <jagger>
Fri 06 Aug 2010 05:16:18 AM UTC, comment #3: 

Just I've fixed the issue on GIT head, by following patch.
Please test.

diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 9dce576..13c126f 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1574,6 +1574,7 @@
       FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
                    i, offsets[i], rlen, flags ));
 
+      /* postpone the check of rlen longer than buffer until FT_Stream_Read() */
       if ( ( flags >> 8 ) == 0 )        /* Comment, should not be loaded */
         continue;
 
@@ -1613,6 +1614,10 @@
         pfb_data[pfb_pos++] = 0;
       }
 
+      error = FT_Err_Cannot_Open_Resource;
+      if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
+        goto Exit2;
+
       error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
       if ( error )
         goto Exit2;

suzuki toshiya <mpsuzuki>
Group administrator
Thu 05 Aug 2010 11:25:02 PM UTC, comment #2: 

The issue is reproduced on i386 too,
thank you for reporting.

suzuki toshiya <mpsuzuki>
Group administrator
Thu 05 Aug 2010 11:15:15 PM UTC, comment #1: 

Toshiya-san, please take care of it.  It seems to me that in this routine some more bounding checks are missing...

Werner LEMBERG <wl>
Group administrator
Thu 05 Aug 2010 01:46:39 PM UTC, original submission:  

Font: http://alt.swiecki.net/j/f/sigsegv31.ttf

$ gdb ./ftbench
(gdb) r -c 1 sigsegv31.ttf

Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/x86_64/memcpy.S:267
267 ../sysdeps/x86_64/memcpy.S: No such file or directory.
in ../sysdeps/x86_64/memcpy.S
(gdb) bt
#0  memcpy () at ../sysdeps/x86_64/memcpy.S:267
#1  0x000000000040e4de in FT_Stream_ReadAt (stream=0x6aca00, pos=159050, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:145
#2  0x000000000040e428 in FT_Stream_Read (stream=0x6aca00, buffer=0x7ffff7f99a0c "\245\330\346[\370H\026\a\331\373\261\063\250\\", count=2046) at /usr/local/google/src/freetype2/src/base/ftstream.c:114
#3  0x0000000000406e99 in Mac_Read_POST_Resource (library=0x6a7040, stream=0x6aca00, offsets=0x6ad1f0, resource_cnt=120, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1616
#4  0x0000000000407283 in IsMacResource (library=0x6a7040, stream=0x6aca00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1747
#5  0x00000000004074f6 in IsMacBinary (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1822
#6  0x000000000040772e in load_mac_face (library=0x6a7040, stream=0x6aca00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1922
#7  0x0000000000407b44 in FT_Open_Face (library=0x6a7040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2083
#8  0x000000000040650a in FT_New_Face (library=0x6a7040, pathname=0x7fffffffe979 "sigsegv31.ttf", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#9  0x0000000000402319 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:616
#10 0x0000000000402603 in main (argc=1, argv=0x7fffffffe660) at /usr/local/google/src/freetype2-demos/src/ftbench.c:740



$ valgrind ./ftbench -c 1 sigsegv31.ttf
==30068== Memcheck, a memory error detector
==30068== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==30068== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==30068== Command: ./ftbench -c 1 sigsegv31.ttf
==30068==
==30068== Invalid write of size 1
==30068==    at 0x4C29E5D: memcpy (mc_replace_strmem.c:497)
==30068==    by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068==    by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068==    by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068==    by 0x407282: IsMacResource (ftobjs.c:1747)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x53fd9ab is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068==    at 0x4C29E67: memcpy (mc_replace_strmem.c:497)
==30068==    by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068==    by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068==    by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068==    by 0x407282: IsMacResource (ftobjs.c:1747)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x53fd9aa is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068==    at 0x4C29E72: memcpy (mc_replace_strmem.c:497)
==30068==    by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068==    by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068==    by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068==    by 0x407282: IsMacResource (ftobjs.c:1747)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x53fd9a9 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068==    at 0x4C29E7D: memcpy (mc_replace_strmem.c:497)
==30068==    by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068==    by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068==    by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068==    by 0x407282: IsMacResource (ftobjs.c:1747)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x53fd9a8 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Invalid write of size 1
==30068==    at 0x4C29EBC: memcpy (mc_replace_strmem.c:497)
==30068==    by 0x40E4DD: FT_Stream_ReadAt (ftstream.c:145)
==30068==    by 0x40E427: FT_Stream_Read (ftstream.c:114)
==30068==    by 0x406E98: Mac_Read_POST_Resource (ftobjs.c:1616)
==30068==    by 0x407282: IsMacResource (ftobjs.c:1747)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x53fd9ad is not stack'd, malloc'd or (recently) free'd
==30068==
==30068== Use of uninitialised value of size 8
==30068==    at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==
==30068== Invalid write of size 8
==30068==    at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==30068==
==30068==
==30068== Process terminating with default action of signal 11 (SIGSEGV)
==30068==  Access not within mapped region at address 0x0
==30068==    at 0x4072AE: IsMacResource (ftobjs.c:1752)
==30068==    by 0x4074F5: IsMacBinary (ftobjs.c:1822)
==30068==    by 0x40772D: load_mac_face (ftobjs.c:1922)
==30068==    by 0x407B43: FT_Open_Face (ftobjs.c:2083)
==30068==    by 0x406509: FT_New_Face (ftobjs.c:1196)
==30068==    by 0x402318: get_face (ftbench.c:616)
==30068==    by 0x402602: main (ftbench.c:740)
==30068==  If you believe this happened as a result of a stack
==30068==  overflow in your program's main thread (unlikely but
==30068==  possible), you can try to increase the size of the
==30068==  main thread stack using the --main-stacksize= flag.
==30068==  The main thread stack size used in this run was 8388608.
==30068==
==30068== HEAP SUMMARY:
==30068==     in use at exit: 22,608 bytes in 39 blocks
==30068==   total heap usage: 67 allocs, 28 frees, 213,694 bytes allocated
==30068==
==30068== LEAK SUMMARY:
==30068==    definitely lost: 0 bytes in 0 blocks
==30068==    indirectly lost: 0 bytes in 0 blocks
==30068==      possibly lost: 0 bytes in 0 blocks
==30068==    still reachable: 22,608 bytes in 39 blocks
==30068==         suppressed: 0 bytes in 0 blocks
==30068== Rerun with --leak-check=full to see details of leaked memory
==30068==
==30068== For counts of detected and suppressed errors, rerun with: -v
==30068== Use --track-origins=yes to see where uninitialised values come from
==30068== ERROR SUMMARY: 80166 errors from 7 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #21149:  sigsegv31.ttf added by jagger (237KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mpsuzuki (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-06 mpsuzuki StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2010-08-06 mpsuzuki StatusConfirmed Ready For Test
        Planned ReleaseNone 2.4.2
    2010-08-05 mpsuzuki StatusNone Confirmed
    2010-08-05 wl Assigned toNone mpsuzuki
    2010-08-05 jagger Attached File- Added sigsegv31.ttf, #21149

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code