bugThe FreeType Project - Bugs: bug #49858, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49858: heap-buffer-overflow in cff_parser_run()

Submitter:  Tyson Smith <twsmith>
Submitted:  Fri 16 Dec 2016 03:44:26 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.7.1

Fri 16 Dec 2016 07:52:51 AM UTC, comment #1: 

Fixed in git, thanks!

Werner LEMBERG <wl>
Group administrator
Fri 16 Dec 2016 03:44:26 AM UTC, original submission:  

Found while fuzzing with FTFuzzer with ASan build.
Commit 01658be6fbda2ff17616158ae5df5dc240a4347c

==4440==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000009300 at pc 0x0000005df312 bp 0x7fff98c6eb30 sp 0x7fff98c6eb28
WRITE of size 8 at 0x617000009300 thread T0
    #0 0x5df311 in cff_parser_run src/cff/cffparse.c:1430:22
    #1 0x5fe7d6 in cff_subfont_load src/cff/cffload.c:1986:15
    #2 0x59319b in cff_font_load src/cff/cffload.c:2202:13
    #3 0x59319b in cff_face_init src/cff/cffobjs.c:593
    #4 0x502640 in open_face src/base/ftobjs.c:1180:15
    #5 0x500116 in FT_Open_Face src/base/ftobjs.c:2195:19
    #6 0x501fe5 in FT_New_Memory_Face src/base/ftobjs.c:1270:12
    #7 0x4ed6f0 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:149:14
    #8 0x4ee5bd in main src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:241:9
    #9 0x7f17d0af482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x418f98 in _start (/home/ubuntu/build/build/ftfuzzer+0x418f98)

0x617000009300 is located 0 bytes to the right of 768-byte region [0x617000009000,0x617000009300)
allocated by thread T0 here:
    #0 0x4b90c8 in __interceptor_malloc (/home/ubuntu/build/build/ftfuzzer+0x4b90c8)
    #1 0x52d607 in ft_mem_qalloc src/base/ftutil.c:76:15
    #2 0x52d607 in ft_mem_alloc src/base/ftutil.c:55
    #3 0x52d607 in ft_mem_qrealloc src/base/ftutil.c:146
    #4 0x5fe27c in cff_parser_init src/cff/cffparse.c:65:10
    #5 0x5fe27c in cff_subfont_load src/cff/cffload.c:1931
    #6 0x59319b in cff_font_load src/cff/cffload.c:2202:13
    #7 0x59319b in cff_face_init src/cff/cffobjs.c:593
    #8 0x502640 in open_face src/base/ftobjs.c:1180:15

SUMMARY: AddressSanitizer: heap-buffer-overflow src/cff/cffparse.c:1430:22 in cff_parser_run
Shadow bytes around the buggy address:
  0x0c2e7fff9210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fff9260:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff9270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff9280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff9290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff92a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff92b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4440==ABORTING

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #39246:  test_case.ttf added by twsmith (1014B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by twsmith (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-12-16 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.7.1
    2016-12-16 twsmith Attached File- Added test_case.ttf, #39246

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code