bugThe FreeType Project - Bugs: bug #30657, Crash - SIGSEGV -...

 
 

bug #30657: Crash - SIGSEGV - user-controllable read in truetype/ttinterp.c:1687

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Thu 05 Aug 2010 12:46:03 PM UTC  
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  2.4.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 06 Aug 2010 05:35:53 PM UTC, comment #4:

Yes, please file a new bug report, and please dig deeper since such bugs are hard to fix by me if I can reproduce them.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 06 Aug 2010 04:11:43 PM UTC, comment #3:

(gdb) p pcell
$1 = (PCell *) 0xfc000008006a8b50

So this address is composed of two 32bit pieces.

0x006a8b50 lies perfectly in the process' address space, but the upper parth 0xfc000008 seems random. I guess it's a stack based buffer overflow, which overwrites upper part of this variable.

I can dig deeper if you need it to fix it.

Robert Swiecki <jagger>
Fri 06 Aug 2010 03:30:05 PM UTC, comment #2:

So, it's crashing now in another place (after ages of rendering)

Font file: sigsegv30.ttf

Do you want me to file another bug for it?

$ gdb ./ftbench

(gdb) r -c 1 sigsegv30.ttf
Starting program: /usr/local/google/fuzz/ttf/ftbench -c 1 sigsegv30.ttf
Load : 35.370 us/op
Load_Advances (Normal) : 0.212 us/op
Load_Advances (Fast) : 0.056 us/op
Render :
Program received signal SIGSEGV, Segmentation fault.
0x000000000046e4b6 in gray_find_cell (worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:472
472 cell = *pcell;

(gdb) bt
#0 0x000000000046e4b6 in gray_find_cell (worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:472
#1 0x000000000046e5c8 in gray_record_cell (worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:503
#2 0x000000000046e687 in gray_set_cell (worker=0x6a81d0, ex=-1, ey=-36028792723996671) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:546
#3 0x000000000046f096 in gray_render_line (worker=0x6a81d0, to_x=884300, to_y=1576) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:837
#4 0x0000000000470015 in gray_line_to (to=0x7fffffffdd80, worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:1154
#5 0x000000000040b984 in FT_Outline_Decompose (outline=0x6a88f8, func_interface=0x4881e0, user=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/base/ftoutln.c:160
#6 0x0000000000470696 in gray_convert_glyph_inner (worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:1724
#7 0x0000000000470be7 in gray_convert_glyph (worker=0x6a81d0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:1845
#8 0x00000000004710e9 in gray_raster_render (raster=0x6ad7a0, params=0x7fffffffe200) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftgrays.c:1975
#9 0x000000000047174d in ft_smooth_render_generic (render=0x6ad6e0, slot=0x6af710, mode=FT_RENDER_MODE_NORMAL, origin=0x0, required_mode=FT_RENDER_MODE_NORMAL)
at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftsmooth.c:274
#10 0x00000000004719cb in ft_smooth_render (render=0x6ad6e0, slot=0x6af710, mode=FT_RENDER_MODE_NORMAL, origin=0x0) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/smooth/ftsmooth.c:360
#11 0x000000000040a936 in FT_Render_Glyph_Internal (library=0x6a8040, slot=0x6af710, render_mode=FT_RENDER_MODE_NORMAL) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/base/ftobjs.c:3914
#12 0x000000000040aa0b in FT_Render_Glyph (slot=0x6af710, render_mode=FT_RENDER_MODE_NORMAL) at /usr/local/google/src/freetype2-c9de9cbd56caea5ceeab8d984e71441803c41aef/src/base/ftobjs.c:3954
#13 0x0000000000401947 in test_render (timer=0x7fffffffe480, face=0x6ada70, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:270
#14 0x00000000004016fe in benchmark (face=0x6ada70, test=0x7fffffffe4f0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#15 0x0000000000402869 in main (argc=1, argv=0x7fffffffe660) at /usr/local/google/src/freetype2-demos/src/ftbench.c:813

(gdb) p pcell
$1 = (PCell *) 0xfc000008006a8b50 <-- definitely invalid address

Robert Swiecki <jagger>
Thu 05 Aug 2010 10:49:36 PM UTC, comment #1:

I think I've fixed the two bugs (which are different as far as I can see). I believe it's a 64bit issue which I can't reproduce on my system, so please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 05 Aug 2010 12:46:03 PM UTC, original submission:

I have two font files, but problem is probably the same in both cases:

http://alt.swiecki.net/j/f/sigsegv30.ttf
http://alt.swiecki.net/j/f/sigsegv30_1.ttf

$ gdb ./ftbench
(gdb) r -c 1 sigsegv30.ttf

Program received signal SIGSEGV, Segmentation fault.
0x0000000000418e84 in Read_CVT (exc=0x6ab340, idx=7743826034688) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:1687
1687 return CUR.cvt[idx];
(gdb) p/x idx
$1 = 0x70b00000000

(gdb) bt
#0 0x0000000000418e84 in Read_CVT (exc=0x6ab340, idx=7743826034688) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:1687
#1 0x000000000041d6b7 in Ins_MIRP (exc=0x6ab340, args=0x6b2e60) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:6183
#2 0x0000000000420c16 in TT_RunIns (exc=0x6ab340) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:8015
#3 0x0000000000418ab4 in TT_Run_Context (exec=0x6ab340, debug=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
#4 0x0000000000413b36 in TT_Hint_Glyph (loader=0x7fffffffe160, is_composite=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
#5 0x000000000041410b in TT_Process_Simple_Glyph (loader=0x7fffffffe160) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
#6 0x00000000004150ec in load_truetype_glyph (loader=0x7fffffffe160, glyph_index=44513, recurse_count=0, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
#7 0x0000000000416526 in TT_Load_Glyph (size=0x6ae950, glyph=0x6ae700, glyph_index=44513, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
#8 0x00000000004118bf in Load_Glyph (ttslot=0x6ae700, ttsize=0x6ae950, glyph_index=44513, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
#9 0x0000000000405a52 in FT_Load_Glyph (face=0x6aca60, glyph_index=44513, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#10 0x00000000004017c4 in test_load (timer=0x7fffffffe480, face=0x6aca60, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:219
#11 0x00000000004016fe in benchmark (face=0x6aca60, test=0x7fffffffe4f0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#12 0x000000000040275f in main (argc=1, argv=0x7fffffffe660) at /usr/local/google/src/freetype2-demos/src/ftbench.c:782

For the second font file

(gdb) r -c 1 sigsegv30_1.ttf

Program received signal SIGSEGV, Segmentation fault.
0x00000000004201af in TT_RunIns (exc=0x6ab340) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7748
7748 DO_RS

(gdb) bt
#0 0x00000000004201af in TT_RunIns (exc=0x6ab340) at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:7748
#1 0x0000000000418ab4 in TT_Run_Context (exec=0x6ab340, debug=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttinterp.c:742
#2 0x0000000000413b36 in TT_Hint_Glyph (loader=0x7fffffffe150, is_composite=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:816
#3 0x000000000041410b in TT_Process_Simple_Glyph (loader=0x7fffffffe150) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:937
#4 0x00000000004150ec in load_truetype_glyph (loader=0x7fffffffe150, glyph_index=49510, recurse_count=1, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1425
#5 0x00000000004156a3 in load_truetype_glyph (loader=0x7fffffffe150, glyph_index=40352, recurse_count=0, header_only=0 '\000') at /usr/local/google/src/freetype2/src/truetype/ttgload.c:1559
#6 0x0000000000416526 in TT_Load_Glyph (size=0x6ae950, glyph=0x6ae700, glyph_index=40352, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttgload.c:2074
#7 0x00000000004118bf in Load_Glyph (ttslot=0x6ae700, ttsize=0x6ae950, glyph_index=40352, load_flags=0) at /usr/local/google/src/freetype2/src/truetype/ttdriver.c:334
#8 0x0000000000405a52 in FT_Load_Glyph (face=0x6aca60, glyph_index=40352, load_flags=0) at /usr/local/google/src/freetype2/src/base/ftobjs.c:677
#9 0x00000000004017c4 in test_load (timer=0x7fffffffe470, face=0x6aca60, user_data=0x0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:219
#10 0x00000000004016fe in benchmark (face=0x6aca60, test=0x7fffffffe4e0, max_iter=1, max_time=2) at /usr/local/google/src/freetype2-demos/src/ftbench.c:189
#11 0x000000000040275f in main (argc=1, argv=0x7fffffffe650) at /usr/local/google/src/freetype2-demos/src/ftbench.c:782

$ valgrind ./ftbench -c 1 sigsegv30.ttf
==24147== Memcheck, a memory error detector
==24147== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==24147== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==24147== Command: ./ftbench -c 1 sigsegv30.ttf
==24147==
Load : ==24147== Invalid read of size 8
==24147== at 0x418E84: Read_CVT (ttinterp.c:1687)
==24147== by 0x41D6B6: Ins_MIRP (ttinterp.c:6183)
==24147== by 0x420C15: TT_RunIns (ttinterp.c:8015)
==24147== by 0x418AB3: TT_Run_Context (ttinterp.c:742)
==24147== by 0x413B35: TT_Hint_Glyph (ttgload.c:816)
==24147== by 0x41410A: TT_Process_Simple_Glyph (ttgload.c:937)
==24147== by 0x4150EB: load_truetype_glyph (ttgload.c:1425)
==24147== by 0x416525: TT_Load_Glyph (ttgload.c:2074)
==24147== by 0x4118BE: Load_Glyph (ttdriver.c:334)
==24147== by 0x405A51: FT_Load_Glyph (ftobjs.c:677)
==24147== by 0x4017C3: test_load (ftbench.c:219)
==24147== by 0x4016FD: benchmark (ftbench.c:189)
==24147== Address 0x385805402550 is not stack'd, malloc'd or (recently) free'd
==24147==
==24147==
==24147== Process terminating with default action of signal 11 (SIGSEGV)
==24147== Access not within mapped region at address 0x385805402550
==24147== at 0x418E84: Read_CVT (ttinterp.c:1687)
==24147== by 0x41D6B6: Ins_MIRP (ttinterp.c:6183)
==24147== by 0x420C15: TT_RunIns (ttinterp.c:8015)
==24147== by 0x418AB3: TT_Run_Context (ttinterp.c:742)
==24147== by 0x413B35: TT_Hint_Glyph (ttgload.c:816)
==24147== by 0x41410A: TT_Process_Simple_Glyph (ttgload.c:937)
==24147== by 0x4150EB: load_truetype_glyph (ttgload.c:1425)
==24147== by 0x416525: TT_Load_Glyph (ttgload.c:2074)
==24147== by 0x4118BE: Load_Glyph (ttdriver.c:334)
==24147== by 0x405A51: FT_Load_Glyph (ftobjs.c:677)
==24147== by 0x4017C3: test_load (ftbench.c:219)
==24147== by 0x4016FD: benchmark (ftbench.c:189)
==24147== If you believe this happened as a result of a stack
==24147== overflow in your program's main thread (unlikely but
==24147== possible), you can try to increase the size of the
==24147== main thread stack using the --main-stacksize= flag.
==24147== The main thread stack size used in this run was 8388608.
==24147==
==24147== HEAP SUMMARY:
==24147== in use at exit: 650,418 bytes in 75 blocks
==24147== total heap usage: 143 allocs, 68 frees, 905,194 bytes allocated
==24147==
==24147== LEAK SUMMARY:
==24147== definitely lost: 0 bytes in 0 blocks
==24147== indirectly lost: 0 bytes in 0 blocks
==24147== possibly lost: 0 bytes in 0 blocks
==24147== still reachable: 650,418 bytes in 75 blocks
==24147== suppressed: 0 bytes in 0 blocks
==24147== Rerun with --leak-check=full to see details of leaked memory
==24147==
==24147== For counts of detected and suppressed errors, rerun with: -v
==24147== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault

$ valgrind ./ftbench -c 1 sigsegv30_1.ttf
==27187== Memcheck, a memory error detector
==27187== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==27187== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==27187== Command: ./ftbench -c 1 sigsegv30_1.ttf
==27187==
Load : ==27187== Invalid read of size 8
==27187== at 0x4201AF: TT_RunIns (ttinterp.c:7748)
==27187== by 0x418AB3: TT_Run_Context (ttinterp.c:742)
==27187== by 0x413B35: TT_Hint_Glyph (ttgload.c:816)
==27187== by 0x41410A: TT_Process_Simple_Glyph (ttgload.c:937)
==27187== by 0x4150EB: load_truetype_glyph (ttgload.c:1425)
==27187== by 0x4156A2: load_truetype_glyph (ttgload.c:1559)
==27187== by 0x416525: TT_Load_Glyph (ttgload.c:2074)
==27187== by 0x4118BE: Load_Glyph (ttdriver.c:334)
==27187== by 0x405A51: FT_Load_Glyph (ftobjs.c:677)
==27187== by 0x4017C3: test_load (ftbench.c:219)
==27187== by 0x4016FD: benchmark (ftbench.c:189)
==27187== by 0x40275E: main (ftbench.c:782)
==27187== Address 0x68005405770 is not stack'd, malloc'd or (recently) free'd
==27187==
==27187==
==27187== Process terminating with default action of signal 11 (SIGSEGV)
==27187== Access not within mapped region at address 0x68005405770
==27187== at 0x4201AF: TT_RunIns (ttinterp.c:7748)
==27187== by 0x418AB3: TT_Run_Context (ttinterp.c:742)
==27187== by 0x413B35: TT_Hint_Glyph (ttgload.c:816)
==27187== by 0x41410A: TT_Process_Simple_Glyph (ttgload.c:937)
==27187== by 0x4150EB: load_truetype_glyph (ttgload.c:1425)
==27187== by 0x4156A2: load_truetype_glyph (ttgload.c:1559)
==27187== by 0x416525: TT_Load_Glyph (ttgload.c:2074)
==27187== by 0x4118BE: Load_Glyph (ttdriver.c:334)
==27187== by 0x405A51: FT_Load_Glyph (ftobjs.c:677)
==27187== by 0x4017C3: test_load (ftbench.c:219)
==27187== by 0x4016FD: benchmark (ftbench.c:189)
==27187== by 0x40275E: main (ftbench.c:782)
==27187== If you believe this happened as a result of a stack
==27187== overflow in your program's main thread (unlikely but
==27187== possible), you can try to increase the size of the
==27187== main thread stack using the --main-stacksize= flag.
==27187== The main thread stack size used in this run was 8388608.
==27187==
==27187== HEAP SUMMARY:
==27187== in use at exit: 361,018 bytes in 75 blocks
==27187== total heap usage: 138 allocs, 63 frees, 537,194 bytes allocated
==27187==
==27187== LEAK SUMMARY:
==27187== definitely lost: 0 bytes in 0 blocks
==27187== indirectly lost: 0 bytes in 0 blocks
==27187== possibly lost: 0 bytes in 0 blocks
==27187== still reachable: 361,018 bytes in 75 blocks
==27187== suppressed: 0 bytes in 0 blocks
==27187== Rerun with --leak-check=full to see details of leaked memory
==27187==
==27187== For counts of detected and suppressed errors, rerun with: -v
==27187== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
Segmentation fault

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-06 wl StatusReady For Test => Fixed
    2010-08-05 wl StatusNone => Ready For Test
        Assigned toNone => wl
        Open/ClosedOpen => Closed
        Planned ReleaseNone => 2.4.2

    Back to the top


    Powered by Savane 3.3