bugThe FreeType Project - Bugs: bug #30719, Crash - SIGSEGV - Read from...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30719: Crash - SIGSEGV - Read from uninitialized (probably user-controllable) memory in src/smooth/ftgrays.c:472

Submitter:  Robert Swiecki <jagger>
Submitted:  Mon 09 Aug 2010 08:00:35 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  None

Thu 12 Aug 2010 05:02:52 AM UTC, comment #3: 

OK, marked as closed.  Thanks for testing.

Werner LEMBERG <wl>
Group administrator
Wed 11 Aug 2010 04:07:35 PM UTC, comment #2: 

Yeah, looks good to me.

Robert Swiecki <jagger>
Tue 10 Aug 2010 01:03:40 AM UTC, comment #1: 

This could be fixed now.  Please test the git version.

Werner LEMBERG <wl>
Group administrator
Mon 09 Aug 2010 08:00:35 PM UTC, original submission:  

Font: http://alt.swiecki.net/j/f/sigsegv30.ttf
Platform: Linux/amd64

I modified ftbench source, adding to the inner loop of the "test_render" function the following code

===
    if (i != 21318)
      continue;
===

It makes things much easier

$ gdb ./21318_ftbench

(gdb) r -c 1 sigsegv30.ttf
Starting program: /usr/local/google/fuzz/ttf/21318_ftbench -c 1 sigsegv30.ttf
Load                      : 35.376 us/op
Load_Advances (Normal)    : 0.210 us/op
Load_Advances (Fast)      : 0.056 us/op
Render                    :
Program received signal SIGSEGV, Segmentation fault.
0x000000000046e536 in gray_find_cell (worker=0x6a81d0) at /usr/local/google/src/freetype2/src/smooth/ftgrays.c:472
472       cell = *pcell;

pcell starts with

pcell = &ras.ycells[ras.ey];

but

(gdb) p worker->ycells[worker->ey]
Cannot access memory at address 0x1000000006a8cf8

(gdb) p worker->ycells
$1 = (PCell *) 0x6a8b50 <-- looks good, but

(gdb) p/x worker->ey
$3 = 0x20000000000035   <-- it's huge, making the ycells table offset out of bounds.

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by jagger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-12 wl StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2010-08-10 wl StatusNone Ready For Test
        Assigned toNone wl

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code