bugThe FreeType Project - Bugs: bug #30145, NULL-ptr deref in psaux/psobjs.c...

 
 

bug #30145: NULL-ptr deref in psaux/psobjs.c (.pfa font)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Tue 15 Jun 2010 07:29:00 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 20 Jun 2010 02:28:19 PM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 15 Jun 2010 07:29:00 PM UTC, original submission:

git sources as of Jun 2010-06-15

Font: http://alt.swiecki.net/j/f/sigsegv8.pfa

gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) - library and tools compiled with -m32 -O0 -g

$ gdb ./ftbench
(gdb) r -c 1 sigsegv8.pfa
Program received signal SIGSEGV, Segmentation fault.
0x080afabe in t1_builder_add_contour (builder=0xffffcee4) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
1594 outline->n_contours++;

(gdb) p outline
$1 = (FT_Outline *) 0x0

(gdb) bt
#0 0x080afabe in t1_builder_add_contour (builder=0xffffcee4) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
#1 0x080afba3 in t1_builder_start_point (builder=0xffffcee4, x=0, y=0) at /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
#2 0x080b1046 in t1_decoder_parse_charstrings (decoder=0xffffcee4,
charstring_base=0x80dba7c "frL\312$xJޯc\370\021\234\066\b\005\276\065p\240)\345c\005\061\tV\231k\245\374\376\251\375I\032\001\225q\020\307\062\350E\215\327c\\)\310\325\070\256\212r", charstring_len=97)
at /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
#3 0x0806a88e in T1_Parse_Glyph_And_Get_Char_String (decoder=0xffffcee4, glyph_index=21, char_string=0xffffce90) at /usr/local/google/src/freetype2/src/type1/t1gload.c:93
#4 0x0806a972 in T1_Parse_Glyph (decoder=0xffffcee4, glyph_index=21) at /usr/local/google/src/freetype2/src/type1/t1gload.c:129
#5 0x0806aad8 in T1_Compute_Max_Advance (face=0x80d2e00, max_advance=0xffffd510) at /usr/local/google/src/freetype2/src/type1/t1gload.c:197
#6 0x0806a447 in T1_Face_Init (stream=0x80d2dd0, face=0x80d2e00, face_index=0, num_params=0, params=0x0) at /usr/local/google/src/freetype2/src/type1/t1objs.c:468
#7 0x0804d0c6 in open_face (driver=0x80d2620, stream=0x80d2dd0, face_index=0, num_params=0, params=0x0, aface=0xffffd5f8) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
#8 0x0804e331 in FT_Open_Face (library=0x80ce020, args=0xffffd630, face_index=0, aface=0xffffd70c) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
#9 0x0804d1bb in FT_New_Face (library=0x80ce020, pathname=0xffffd994 "sigsegv8.pfa", face_index=0, aface=0xffffd70c) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#10 0x08049995 in get_face (face=0xffffd70c) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#11 0x08049c5b in main (argc=1, argv=0xffffd7d0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739

==27444== Command: ./ftbench -c 1 sigsegv8.pfa
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FC8F: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:585
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d87318 is 0 bytes after a block of size 72 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FAAF: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:444
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d87678 is 112 bytes inside a block of size 113 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D30159: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:952
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88250 is 8 bytes before a block of size 170 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FE3F: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:715
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88388 is 80 bytes inside a block of size 82 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 8
==27444== at 0x6D2FADF: __memcpy_ssse3 /build/buildd/eglibc-2.11.1/string/../sysdeps/i386/i686/multiarch/memcpy-ssse3.S:456
==27444== by 0x80688EE: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1618
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x6d88410 is 80 bytes inside a block of size 82 alloc'd
==27444== at 0x47DE0D8: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==27444== by 0x80B3964: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==27444== by 0x8054EB9: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==27444== by 0x8054E53: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==27444== by 0x8068867: parse_charstrings /usr/local/google/src/freetype2/src/type1/t1load.c:1613
==27444== by 0x80677B0: t1_load_keyword /usr/local/google/src/freetype2/src/type1/t1load.c:927
==27444== by 0x8069415: parse_dict /usr/local/google/src/freetype2/src/type1/t1load.c:1960
==27444== by 0x8069761: T1_Open_Face /usr/local/google/src/freetype2/src/type1/t1load.c:2077
==27444== by 0x806A0EF: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:321
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444==
==27444== Invalid read of size 2
==27444== at 0x80AFABE: t1_builder_add_contour /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
==27444== by 0x80AFBA2: t1_builder_start_point /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
==27444== by 0x80B1045: t1_decoder_parse_charstrings /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
==27444== by 0x806A88D: T1_Parse_Glyph_And_Get_Char_String /usr/local/google/src/freetype2/src/type1/t1gload.c:93
==27444== by 0x806A971: T1_Parse_Glyph /usr/local/google/src/freetype2/src/type1/t1gload.c:129
==27444== by 0x806AAD7: T1_Compute_Max_Advance /usr/local/google/src/freetype2/src/type1/t1gload.c:197
==27444== by 0x806A446: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:468
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27444==
==27444==
==27444== Process terminating with default action of signal 11 (SIGSEGV)
==27444== Access not within mapped region at address 0x0
==27444== at 0x80AFABE: t1_builder_add_contour /usr/local/google/src/freetype2/src/psaux/psobjs.c:1594
==27444== by 0x80AFBA2: t1_builder_start_point /usr/local/google/src/freetype2/src/psaux/psobjs.c:1628
==27444== by 0x80B1045: t1_decoder_parse_charstrings /usr/local/google/src/freetype2/src/psaux/t1decode.c:1251
==27444== by 0x806A88D: T1_Parse_Glyph_And_Get_Char_String /usr/local/google/src/freetype2/src/type1/t1gload.c:93
==27444== by 0x806A971: T1_Parse_Glyph /usr/local/google/src/freetype2/src/type1/t1gload.c:129
==27444== by 0x806AAD7: T1_Compute_Max_Advance /usr/local/google/src/freetype2/src/type1/t1gload.c:197
==27444== by 0x806A446: T1_Face_Init /usr/local/google/src/freetype2/src/type1/t1objs.c:468
==27444== by 0x804D0C5: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1110
==27444== by 0x804E330: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1995
==27444== by 0x804D1BA: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==27444== by 0x8049994: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==27444== by 0x8049C5A: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==27444== If you believe this happened as a result of a stack
==27444== overflow in your program's main thread (unlikely but
==27444== possible), you can try to increase the size of the
==27444== main thread stack using the --main-stacksize= flag.
==27444== The main thread stack size used in this run was 8388608.
==27444==
==27444== HEAP SUMMARY:
==27444== in use at exit: 27,281 bytes in 57 blocks
==27444== total heap usage: 140 allocs, 83 frees, 63,918 bytes allocated
==27444==
==27444== LEAK SUMMARY:
==27444== definitely lost: 0 bytes in 0 blocks
==27444== indirectly lost: 0 bytes in 0 blocks
==27444== possibly lost: 0 bytes in 0 blocks
==27444== still reachable: 27,281 bytes in 57 blocks
==27444== suppressed: 0 bytes in 0 blocks

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20758:  sigsegv8.pfa added by jagger (25KiB - application/x-font-type1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 20 Jun 2010 02:28:19 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Tue 15 Jun 2010 07:29:00 PM UTCjaggerAttached File-=>Added sigsegv8.pfa, #20758

    Back to the top


    Powered by Savane 3.1-cleanup1