bugThe FreeType Project - Bugs: bug #30361, Possible heap corruption

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30361: Possible heap corruption

Submitter:  Robert Swiecki <jagger>
Submitted:  Mon 05 Jul 2010 10:08:20 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.3.13

Thu 08 Jul 2010 07:35:04 PM UTC, comment #5: 

Will do so finally in the next few days.

Werner LEMBERG <wl>
Group administrator
Thu 08 Jul 2010 02:20:30 PM UTC, comment #4: 

Btw, are you maybe going with a new release of the freetype2 anytime soon?. I've pinged a few OS vendors to pick-up patches or upgrade to the newest release as soon as it's out, just wondering if this newest release might appear soon.

 Robert Swiecki <jagger>
Thu 08 Jul 2010 01:03:20 PM UTC, comment #3: 

Perfect, no warnings, thanks.

 Robert Swiecki <jagger>
Thu 08 Jul 2010 05:31:20 AM UTC, comment #2: 

Fixed in git.  Please test.

 Werner LEMBERG <wl>
Group administrator
Tue 06 Jul 2010 01:36:53 PM UTC, comment #1: 

Ooppsss. it's just invalid pointer to realloc, I was grepping for wrong address in the previous example:

$ MALLOC_CHECK_=2 LD_PRELOAD=./libdalloc.so ./ftbench -c 1 sigabrt28.ttf | grep 6af560
REALLOC: PTR: 0x6afd00 SIZE: 1024, RET: 0x6af560

So, the 0x6af560 (in my case) is realloc()ated, but it had never been malloc()ed or calloc()ed before.

 Robert Swiecki <jagger>
Mon 05 Jul 2010 10:08:20 PM UTC, original submission:  

I think that's really the last one :)

gcc -O0 -g
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), Linux amd64
File: http://alt.swiecki.net/j/f/sigabrt28.ttf

The address passed to realloc() seems valid, I debugged it with simple memory debugger (a preloaded lib intercepting malloc, free, calloc, realloc), and it's been allocated, so the only reasonable answer to this for me must be corruption of the heap metadata (typically buffer overflow)

$ MALLOC_CHECK_=3 LD_PRELOAD=./libdalloc.so ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf | grep 6af500
MALLOC: SIZE: 8, RET: 0x6af500
REALLOC: PTR: 0x6af500 SIZE: 16, RET: 0x6af500
* glibc detected * ./ftbench: realloc(): invalid pointer: 0x00000000006af560 *
======= Backtrace: =========
...

and the full output w/o libdalloc.so

$ MALLOC_CHECK_=3 ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
Load                      : * glibc detected * ./ftbench: realloc(): invalid pointer: 0x00000000006af560 *
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7ffff78b95b6]
/lib/libc.so.6(+0x7ed33)[0x7ffff78c0d33]
./ftbench[0x47ed95]
./ftbench[0x410238]
./ftbench[0x4100dc]
./ftbench[0x4045fc]
./ftbench[0x412c73]
./ftbench[0x4150b5]
./ftbench[0x416526]
./ftbench[0x4118bf]
./ftbench[0x405a52]
./ftbench[0x4017c4]
./ftbench[0x4016fe]
./ftbench[0x40275f]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ffff7860c4d]
./ftbench[0x4014e9]
======= Memory map: ========
00400000-004a6000 r-xp 00000000 08:06 25976833                           /usr/local/google/fuzz/ttf/ftbench
006a5000-006a6000 r--p 000a5000 08:06 25976833                           /usr/local/google/fuzz/ttf/ftbench
006a6000-006a7000 rw-p 000a6000 08:06 25976833                           /usr/local/google/fuzz/ttf/ftbench
006a7000-006c8000 rw-p 00000000 00:00 0                                  [heap]
7ffff762b000-7ffff7641000 r-xp 00000000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7641000-7ffff7840000 ---p 00016000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7840000-7ffff7841000 r--p 00015000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7841000-7ffff7842000 rw-p 00016000 08:01 1351719                    /lib/libgcc_s.so.1
7ffff7842000-7ffff79bc000 r-xp 00000000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff79bc000-7ffff7bbb000 ---p 0017a000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bbb000-7ffff7bbf000 r--p 00179000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bbf000-7ffff7bc0000 rw-p 0017d000 08:01 1352099                    /lib/libc-2.11.1.so
7ffff7bc0000-7ffff7bc5000 rw-p 00000000 00:00 0
7ffff7bc5000-7ffff7bdb000 r-xp 00000000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7bdb000-7ffff7dda000 ---p 00016000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7dda000-7ffff7ddb000 r--p 00015000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7ddb000-7ffff7ddc000 rw-p 00016000 08:01 1351768                    /lib/libz.so.1.2.3.3
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0
7ffff7fee000-7ffff7fef000 rw-p 00000000 00:00 0
7ffff7fef000-7ffff7ff9000 r--p 00000000 08:06 25976849                   /usr/local/google/fuzz/ttf/SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096                    /lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

valgrind:

$ valgrind ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205== Memcheck, a memory error detector
==23205== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==23205== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==23205== Command: ./ftbench -c 1 SIGABRT.PC.0x7ffff7875a75.CODE.-6.ADDR.0x110200000105d.INSTR.cmp_rax,_0xfffff000.ttf
==23205==
==23205== Invalid read of size 1
==23205==    at 0x41EE93: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6773
==23205==    by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205==    by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205==    by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205==    by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205==    by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205==    by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205==    by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205==    by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205==    by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205==    by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==    by 0x40275E: main /usr/local/google/src/freetype2-demos/src/ftbench.c:782
==23205==  Address 0x53d28f0 is 0 bytes after a block of size 64 alloc'd
==23205==    at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205==    by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205==    by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205==    by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205==    by 0x40463A: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:225
==23205==    by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205==    by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205==    by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205==    by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205==    by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205==    by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205==    by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205== Invalid write of size 8
==23205==    at 0x41ECEE: _iup_worker_interpolate /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6700
==23205==    by 0x41EF1F: Ins_IUP /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6791
==23205==    by 0x41FF92: TT_RunIns /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7687
==23205==    by 0x418AB3: TT_Run_Context /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
==23205==    by 0x413B35: TT_Hint_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
==23205==    by 0x41410A: TT_Process_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
==23205==    by 0x4150EB: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
==23205==    by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205==    by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205==    by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205==    by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205==    by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==  Address 0x53d2870 is 0 bytes after a block of size 1,024 alloc'd
==23205==    at 0x4C28DC6: realloc /tmp/vg/coregrind/m_replacemalloc/vg_replace_malloc.c:566
==23205==    by 0x47ED94: ft_realloc /usr/local/google/src/freetype2/builds/unix/ftsystem.c:135
==23205==    by 0x410237: ft_mem_qrealloc /usr/local/google/src/freetype2/src/base/ftutil.c:154
==23205==    by 0x4100DB: ft_mem_realloc /usr/local/google/src/freetype2/src/base/ftutil.c:101
==23205==    by 0x4045FB: FT_GlyphLoader_CheckPoints /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
==23205==    by 0x412C72: TT_Load_Simple_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
==23205==    by 0x4150B4: load_truetype_glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
==23205==    by 0x416525: TT_Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
==23205==    by 0x4118BE: Load_Glyph /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
==23205==    by 0x405A51: FT_Load_Glyph /usr/local/google/src/freetype2/src/base/ftobjs.c:677
==23205==    by 0x4017C3: test_load /usr/local/google/src/freetype2-demos/src/ftbench.c:219
==23205==    by 0x4016FD: benchmark /usr/local/google/src/freetype2-demos/src/ftbench.c:189
==23205==
==23205==
==23205== HEAP SUMMARY:
==23205==     in use at exit: 0 bytes in 0 blocks
==23205==   total heap usage: 2,031 allocs, 2,031 frees, 340,840 bytes allocated
==23205==
==23205== All heap blocks were freed -- no leaks are possible
==23205==
==23205== For counts of detected and suppressed errors, rerun with: -v
==23205== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 4 from 0)


gdb:

$ MALLOC_CHECK_=3 gdb ./ftbench
(gdb) r -c 1 sigabrt28.ttf

Program received signal SIGABRT, Aborted.
0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c

(gdb) bt
#0  0x00007ffff7875a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff78795c0 in *__GI_abort () at abort.c:92
#2  0x00007ffff78af4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3  0x00007ffff78b95b6 in malloc_printerr (action=3, str=0x7ffff7989bee "realloc(): invalid pointer", ptr=<value optimized out>) at malloc.c:6264
#4  0x00007ffff78c0d33 in realloc_check (oldmem=0x6af560, bytes=1280, caller=<value optimized out>) at hooks.c:330
#5  0x000000000047ed95 in ft_realloc (memory=0x6a7010, cur_size=1024, new_size=1280, block=0x6af560) at builds/unix/ftsystem.c:135
#6  0x0000000000410238 in ft_mem_qrealloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe28c) at /usr/local/google/src/freetype2/src/base/ftutil.c:154
#7  0x00000000004100dc in ft_mem_realloc (memory=0x6a7010, item_size=16, cur_count=64, new_count=80, block=0x6af560, p_error=0x7fffffffe2e8) at /usr/local/google/src/freetype2/src/base/ftutil.c:101
#8  0x00000000004045fc in FT_GlyphLoader_CheckPoints (loader=0x6add50, n_points=77, n_contours=0) at /usr/local/google/src/freetype2/src/base/ftgloadr.c:224
#9  0x0000000000412c73 in TT_Load_Simple_Glyph (load=0x7fffffffe550) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:408
#10 0x00000000004150b5 in load_truetype_glyph (loader=0x7fffffffe550, glyph_index=8, recurse_count=0, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1417
#11 0x0000000000416526 in TT_Load_Glyph (size=0x6ade10, glyph=0x6adbb0, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
#12 0x00000000004118bf in Load_Glyph (ttslot=0x6adbb0, ttsize=0x6ade10, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
#13 0x0000000000405a52 in FT_Load_Glyph (face=0x6acb40, glyph_index=8, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#14 0x00000000004017c4 in test_load (timer=0x7fffffffe870, face=0x6acb40, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:219
#15 0x00000000004016fe in benchmark (face=0x6acb40, test=0x7fffffffe8e0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#16 0x000000000040275f in main (argc=1, argv=0x7fffffffea50) at /usr/local/google/src/freetype2-demos/src/ftbench.c:782


Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #20903:  sigabrt28.ttf added by jagger (38KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-07-08 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.3.13
    2010-07-05 jagger Attached File- Added sigabrt28.ttf, #20903

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-c8cf.
    Corresponding source code