bugThe FreeType Project - Bugs: bug #30168, Two cases of stack underflow (aka....

 
 

bug #30168: Two cases of stack underflow (aka. exhaustion?) in the PFR decoder

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 17 Jun 2010 12:44:05 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.13

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 21 Jun 2010 07:29:53 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 17 Jun 2010 12:44:05 PM UTC, original submission:

git sources as of Jun 15, 2010

gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), the lib and the tools compiled with "-m32 -O0 -g"

two test-cases, but crashing on different instructions under x86 - "call edx", and "mov_[esp+0x8], edx" - what clearly shows it's a stack underflow

http://alt.swiecki.net/j/f/sigsegv10.pfr
http://alt.swiecki.net/j/f/sigsegv11.pfr

$ gdb ./ftbench
(gdb) r -c 1 sigsegv10.pfr
Program received signal SIGSEGV, Segmentation fault.
0x080b397a in ft_realloc (memory=0x80ce008, cur_size=4492320, new_size=4492416, block=0xf7724008) at builds/unix/ftsystem.c:135
135 return realloc( block, new_size );
(gdb) bt
#0 0x080b397a in ft_realloc (memory=0x80ce008, cur_size=4492320, new_size=4492416, block=0xf7724008) at builds/unix/ftsystem.c:135
#1 0x08055042 in ft_mem_qrealloc (memory=0x80ce008, item_size=24, cur_count=187180, new_count=187184, block=0xf7724008, p_error=0xff5fe07c) at /usr/local/google/src/freetype2/src/base/ftutil.c:154
#2 0x08054f24 in ft_mem_realloc (memory=0x80ce008, item_size=24, cur_count=187180, new_count=187184, block=0xf7724008, p_error=0xff5fe0dc) at /usr/local/google/src/freetype2/src/base/ftutil.c:101
#3 0x08079a18 in pfr_glyph_load_compound (glyph=0x80d3100, p=0xf7fd474d "\017\033\"\242\017\063\"o\202\017\234\032\314\006\252\376Z\" {\004 \002\301\003\061Q", limit=0xf7fd4767 "Q")
at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:601
#4 0x08079e19 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:737
#5 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#6 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#7 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#8 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#9 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756
#10 0x08079ea4 in pfr_glyph_load_rec (glyph=0x80d3100, stream=0x80d2dd0, gps_offset=5290, offset=8866, size=27) at /usr/local/google/src/freetype2/src/pfr/pfrgload.c:756

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20769:  sigsegv10.pfr added by jagger (46KiB - application/octet-stream)
file #20770:  sigsegv11.pfr added by jagger (13KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 21 Jun 2010 07:29:53 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.3.13
    Thu 17 Jun 2010 12:44:05 PM UTCjaggerAttached File-=>Added sigsegv10.pfr, #20769
      Attached File-=>Added sigsegv11.pfr, #20770

    Back to the top


    Powered by Savane 3.1-cleanup1