bugThe FreeType Project - Bugs: bug #30719, Crash - SIGSEGV - Read from...

 
 

bug #30719: Crash - SIGSEGV - Read from uninitialized (probably user-controllable) memory in src/smooth/ftgrays.c:472

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Mon 09 Aug 2010 08:00:35 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 12 Aug 2010 05:02:52 AM UTC, comment #3:

OK, marked as closed. Thanks for testing.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 11 Aug 2010 04:07:35 PM UTC, comment #2:

Yeah, looks good to me.

Robert Swiecki <jagger>
Tue 10 Aug 2010 01:03:40 AM UTC, comment #1:

This could be fixed now. Please test the git version.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 09 Aug 2010 08:00:35 PM UTC, original submission:

Font: http://alt.swiecki.net/j/f/sigsegv30.ttf
Platform: Linux/amd64

I modified ftbench source, adding to the inner loop of the "test_render" function the following code

===
if (i != 21318)
continue;
===

It makes things much easier

$ gdb ./21318_ftbench

(gdb) r -c 1 sigsegv30.ttf
Starting program: /usr/local/google/fuzz/ttf/21318_ftbench -c 1 sigsegv30.ttf
Load : 35.376 us/op
Load_Advances (Normal) : 0.210 us/op
Load_Advances (Fast) : 0.056 us/op
Render :
Program received signal SIGSEGV, Segmentation fault.
0x000000000046e536 in gray_find_cell (worker=0x6a81d0) at /usr/local/google/src/freetype2/src/smooth/ftgrays.c:472
472 cell = *pcell;

pcell starts with

pcell = &ras.ycells[ras.ey];

but

(gdb) p worker->ycells[worker->ey]
Cannot access memory at address 0x1000000006a8cf8

(gdb) p worker->ycells
$1 = (PCell *) 0x6a8b50 <-- looks good, but

(gdb) p/x worker->ey
$3 = 0x20000000000035 <-- it's huge, making the ycells table offset out of bounds.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 12 Aug 2010 05:02:52 AM UTCwlStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Tue 10 Aug 2010 01:03:40 AM UTCwlStatusNone=>Ready For Test
      Assigned toNone=>wl

    Back to the top


    Powered by Savane 3.1-cleanup1