bugThe FreeType Project - Bugs: bug #25151, produces syscalls with EINVAL

 
 

bug #25151: produces syscalls with EINVAL

Submitted by:  Behdad Esfahbod <behdad>
Submitted on:  Mon 22 Dec 2008 05:46:49 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.8

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 22 Dec 2008 08:33:28 PM UTC, comment #2:

Thanks.

No, it wasn't crashing or anything, at least the bug doesn't say so. Just that the kernel thinks this input is invalid.

Behdad Esfahbod <behdad>
Mon 22 Dec 2008 06:09:34 PM UTC, comment #1:

I've applied this, thanks. BTW, what is meant with
`the kernel does not like this'? Does it cause an `oops'?
Then the kernel should be fixed too (assuming we are talking
about Linux).

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 22 Dec 2008 05:46:49 PM UTC, original submission:

Bugreport I got at Red Hat:
https://bugzilla.redhat.com/show_bug.cgi?id=477607

It says: Our IDS work shows that the freetype library causes mmap syscalls with EINVAL return codes. This is because its not checking the length of the file before calling mmap. If the file is opened readonly and the length is 0, the kernel does not like it.

And suggests this patch:

diff -urp freetype-2.3.5.orig/builds/unix/ftsystem.c freetype-2.3.5/builds/unix/ftsystem.c
--- freetype-2.3.5.orig/builds/unix/ftsystem.c 2008-12-22 06:52:35.000000000 -0500
+++ freetype-2.3.5/builds/unix/ftsystem.c 2008-12-22 06:55:29.000000000 -0500
@@ -280,6 +280,11 @@
FT_ERROR(( "FT_Stream_Open: file is too big" ));
goto Fail_Map;
}
+ else if ( stat_buf.st_size == 0 )
+ {
+ FT_ERROR(( "FT_Stream_Open: zero length file" ));
+ goto Fail_Map;
+ }

/* This cast potentially truncates a 64bit to 32bit! */
stream->size = (unsigned long)stat_buf.st_size;

Behdad Esfahbod <behdad>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by behdad (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 22 Dec 2008 06:09:34 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.8

    Back to the top


    Powered by Savane 3.1-cleanup1