Mon 28 Jun 2010 02:48:39 PM UTC, comment #6:
I put another font here: http://alt.swiecki.net/j/f/sigabrt24.ttf
When using with MALLOC_CHECK_=3 it exits with SIGABRT, also valgrind shows some inconsistencies. Anyway, I understand that it might be hard to reproduce.
$ MALLOC_CHECK_=3 ./ftbench sigabrt24.ttf
- glibc detected *** ./ftbench: free(): invalid pointer: 0x00000000006add00 ***
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7ffff78b95b6]
./ftbench[0x47fdff]
./ftbench[0x410ab4]
./ftbench[0x40784d]
./ftbench[0x407b13]
./ftbench[0x407d86]
./ftbench[0x407fbe]
./ftbench[0x4083d4]
./ftbench[0x406e2c]
./ftbench[0x402b30]
./ftbench[0x402e9f]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ffff7860c4d]
./ftbench[0x401c79]
======= Memory map: ========
00400000-004a7000 r-xp 00000000 08:06 8995537 /usr/local/google/fuzz/ttf/ftbench
006a6000-006a7000 r--p 000a6000 08:06 8995537 /usr/local/google/fuzz/ttf/ftbench
006a7000-006a8000 rw-p 000a7000 08:06 8995537 /usr/local/google/fuzz/ttf/ftbench
006a8000-006c9000 rw-p 00000000 00:00 0 [heap]
7ffff762b000-7ffff7641000 r-xp 00000000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7641000-7ffff7840000 ---p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7840000-7ffff7841000 r--p 00015000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7841000-7ffff7842000 rw-p 00016000 08:01 1351719 /lib/libgcc_s.so.1
7ffff7842000-7ffff79bc000 r-xp 00000000 08:01 1352099 /lib/libc-2.11.1.so
7ffff79bc000-7ffff7bbb000 ---p 0017a000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbb000-7ffff7bbf000 r--p 00179000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bbf000-7ffff7bc0000 rw-p 0017d000 08:01 1352099 /lib/libc-2.11.1.so
7ffff7bc0000-7ffff7bc5000 rw-p 00000000 00:00 0
7ffff7bc5000-7ffff7bdb000 r-xp 00000000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7bdb000-7ffff7dda000 ---p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7dda000-7ffff7ddb000 r--p 00015000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddb000-7ffff7ddc000 rw-p 00016000 08:01 1351768 /lib/libz.so.1.2.3.3
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0
7ffff7ff1000-7ffff7ff9000 r--p 00000000 08:06 8995860 /usr/local/google/fuzz/ttf/sigabrt24.ttf
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096 /lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted
$ MALLOC_CHECK_=3 gdb ./ftbench
(gdb) r -c 1 sigabrt24.ttf
Program received signal SIGABRT, Aborted.
0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0 0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff78795c0 in *__GI_abort () at abort.c:92
#2 0x00007ffff78af4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff78b95b6 in malloc_printerr (action=3, str=0x7ffff7989ab3 "free(): invalid pointer", ptr=<value optimized out>) at malloc.c:6264
#4 0x000000000047fdff in ft_free (memory=0x6a8010, block=0x6add00) at builds/unix/ftsystem.c:158
#5 0x0000000000410ab4 in ft_mem_free (memory=0x6a8010, P=0x6add00) at /usr/local/google/src/freetype2/src/base/ftutil.c:171
#6 0x000000000040784d in Mac_Read_POST_Resource (library=0x6a8040, stream=0x6adae0, offsets=0x6adc60, resource_cnt=17, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1598
#7 0x0000000000407b13 in IsMacResource (library=0x6a8040, stream=0x6adae0, resource_offset=128, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
#8 0x0000000000407d86 in IsMacBinary (library=0x6a8040, stream=0x6adae0, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
#9 0x0000000000407fbe in load_mac_face (library=0x6a8040, stream=0x6adae0, face_index=0, aface=0x7fffffffe520, args=0x7fffffffe400) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
#10 0x00000000004083d4 in FT_Open_Face (library=0x6a8040, args=0x7fffffffe400, face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
#11 0x0000000000406e2c in FT_New_Face (library=0x6a8040, pathname=0x7fffffffe983 "sigabrt24.ttf", face_index=0, aface=0x7fffffffe520) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#12 0x0000000000402b30 in get_face (face=0x7fffffffe520) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#13 0x0000000000402e9f in main (argc=1, argv=0x7fffffffe650) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739
$ valgrind ./ftbench -c 1 sigabrt24.ttf
VALGRIND_MEMORY_LIMIT_IN_MB=4095; VALGRIND_TIMEOUT=3600
==6217== Memcheck, a memory error detector
==6217== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==6217== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==6217== Command: ./ftbench -c 1 sigabrt24.ttf
==6217==
==6217== Invalid write of size 1
==6217== at 0x4C2A9F4: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217== Address 0x53dd147 is 2 bytes after a block of size 30,069 alloc'd
==6217== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217== by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217== by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217== by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217== by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
==6217== Invalid write of size 1
==6217== at 0x4C2A9FD: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217== Address 0x53dd146 is 1 bytes after a block of size 30,069 alloc'd
==6217== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217== by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217== by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217== by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217== by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
==6217== Invalid write of size 1
==6217== at 0x4C2AA07: memcpy /tmp/vg/memcheck/mc_replace_strmem.c:497
==6217== by 0x40ECFA: FT_Stream_ReadAt /usr/local/google/src/freetype2/src/base/ftstream.c:145
==6217== by 0x40EC44: FT_Stream_Read /usr/local/google/src/freetype2/src/base/ftstream.c:114
==6217== by 0x407769: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1576
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217== Address 0x53dd145 is 0 bytes after a block of size 30,069 alloc'd
==6217== at 0x4C289AA: malloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:236
==6217== by 0x47FDB3: ft_alloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:102
==6217== by 0x410873: ft_mem_qalloc /usr/local/google/src/freetype2/src/base/ftutil.c:76
==6217== by 0x4107FB: ft_mem_alloc /usr/local/google/src/freetype2/src/base/ftutil.c:55
==6217== by 0x407566: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1527
==6217== by 0x407B12: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1703
==6217== by 0x407D85: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1778
==6217== by 0x407FBD: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1878
==6217== by 0x4083D3: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2039
==6217== by 0x406E2B: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==6217== by 0x402B2F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==6217== by 0x402E9E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
==6217==
couldn't load font resource
==6217==
==6217== HEAP SUMMARY:
==6217== in use at exit: 0 bytes in 0 blocks
==6217== total heap usage: 79 allocs, 79 frees, 82,656 bytes allocated
==6217==
==6217== All heap blocks were freed -- no leaks are possible
==6217==
==6217== For counts of detected and suppressed errors, rerun with: -v
==6217== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 4 from 0)
|
Fri 25 Jun 2010 12:35:27 AM UTC, comment #3:
For first, thank you for reporting the issue.
Attached is a smallest fix to make FreeType2
stands with the font "sigsegv16.pfb". It just
checks the return value of FT_Stream_Read()
during the collection of the fragment of PFB
data splitted in Macintosh LaserWriter PS font.
By this patch, the font "sigsegv16.pfb" is
refused as broken, and no SEGV occurs.
Also, it is reasonable that the length, offset
red from the font file should be checked to
prevent a buffer overrun, I will insert more
value checks, to fix security issue.
However, Mac OS X accepts (the validation
of "FontBook.app" accepts) this font. Further
investigation is needed to provide expected
behaviour.
(file #20815)
|
Thu 24 Jun 2010 07:01:05 PM UTC, comment #1:
Some more info
when setting a watchpoint on pfb_pos
Hardware watchpoint 3: pfb_pos
Old value = 32727
New value = -7273265
Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1541
1541
for ( i = 0; i < resource_cnt; ++i )
(gdb) p i
$75 = 16
(gdb) p rlen
$76 = -7305992
So the rlen variable is set to -7305992
And setting watchdog on rlen tells that it's being initialized with that negative value at
Hardware watchpoint 6: rlen
Old value = 2046
New value = -7305990
0x0000000000407d44 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1546
1546 if ( FT_READ_LONG( rlen ) )
|
Thu 24 Jun 2010 06:41:49 PM UTC, original submission:
gcc version 4.4.3, compiled with "-O0 -g"
Font: http://alt.swiecki.net/j/f/sigsegv16.pfb
$ gdb ./ftbench
(gdb) r -c 1 sigsegv16.pfb
Program received signal SIGSEGV, Segmentation fault.
0x0000000000407df7 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
1563 pfb_data[pfb_pos++] = 0x80;
(gdb) x/x pfb_data[pfb_pos]
Cannot access memory at address 0x7ffff1b2b4df
(gdb) p pfb_pos
$1 = -7273265 <-- index is negative
(gdb) bt
#0 0x0000000000407df7 in Mac_Read_POST_Resource (library=0x6a9040, stream=0x6aea00, offsets=0x6aebf0, resource_cnt=24, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
#1 0x000000000040822a in IsMacResource (library=0x6a9040, stream=0x6aea00, resource_offset=128, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
#2 0x000000000040849d in IsMacBinary (library=0x6a9040, stream=0x6aea00, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
#3 0x00000000004086d5 in load_mac_face (library=0x6a9040, stream=0x6aea00, face_index=0, aface=0x7fffffffe540, args=0x7fffffffe420) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
#4 0x0000000000408aed in FT_Open_Face (library=0x6a9040, args=0x7fffffffe420, face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
#5 0x0000000000407544 in FT_New_Face (library=0x6a9040, pathname=0x7fffffffe993 "sigsegv16.pfb", face_index=0, aface=0x7fffffffe540) at /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
#6 0x0000000000403240 in get_face (face=0x7fffffffe540) at /usr/local/google/src/freetype2-demos/src/ftbench.c:615
#7 0x00000000004035af in main (argc=1, argv=0x7fffffffe670) at /usr/local/google/src/freetype2-demos/src/ftbench.c:739
$ valgrind ./ftbench -c 1 sigsegv16.pfb
==25059== Memcheck, a memory error detector
==25059== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==25059== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==25059== Command: ./ftbench -c 1 sigsegv16.pfb
==25059==
==25059==
==25059== Process terminating with default action of signal 11 (SIGSEGV)
==25059== Bad permissions for mapped region at address 0x50D850F
==25059== at 0x407DF7: Mac_Read_POST_Resource /usr/local/google/src/freetype2/src/base/ftobjs.c:1563
==25059== by 0x408229: IsMacResource /usr/local/google/src/freetype2/src/base/ftobjs.c:1701
==25059== by 0x40849C: IsMacBinary /usr/local/google/src/freetype2/src/base/ftobjs.c:1776
==25059== by 0x4086D4: load_mac_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1876
==25059== by 0x408AEC: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2037
==25059== by 0x407543: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1172
==25059== by 0x40323F: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:615
==25059== by 0x4035AE: main /usr/local/google/src/freetype2-demos/src/ftbench.c:739
|