Sat 18 Sep 2010 10:18:04 AM UTC, comment #4:
Thank you for the analysis of the root of issue.
Either I could not find any 16-bit restriction of
CID in CFF spec nor CID-keyed font spec. What
I could find was PostScript Language Reference
Appendix B Table B.1 and PDF Reference Appendix
C Table C.1. It is questionable if we should
understand them as "PDL interpreter limitation"
or "font format limitation".
Checking the current implementation of TrueType
cmap format 8, 10 and 12, the glyph index are
validated to be fitting in maxGID defined by maxp,
and forcibly casted to FT_ULong to FT_UInt.
At present, CFF driver does not have the validator.
I will add the error messages to warn the glyphs
with CID > 0xFFFF are ignored.
|
Mon 06 Sep 2010 01:33:23 PM UTC, original submission:
File: http://alt.swiecki.net/j/f/sigsegv33.ttf
Platform: Linux/amd64
$ gdb ./ftbench
(gdb) r -c 1 sigsegv33.ttf
Program received signal SIGSEGV, Segmentation fault.
0x000000000042e65a in cff_charset_compute_cids (charset=0x6af630, num_glyphs=676, memory=0x6a8010) at /usr/local/google/src/freetype2/src/cff/cffload.c:793
793 charset->cids[charset->sids[j]] = (FT_UShort)j;
(gdb) bt
#0 0x000000000042e65a in cff_charset_compute_cids (charset=0x6af630, num_glyphs=676, memory=0x6a8010)
at /usr/local/google/src/freetype2/src/cff/cffload.c:793
#1 0x000000000042f0d0 in cff_encoding_load (encoding=0x6af218, charset=0x6af630, num_glyphs=676, stream=0x6ada10, base_offset=4068, offset=0)
at /usr/local/google/src/freetype2/src/cff/cffload.c:1241
#2 0x000000000042fcb0 in cff_font_load (library=0x6a8040, stream=0x6ada10, face_index=0, font=0x6af150, pure_cff=0 '\000')
at /usr/local/google/src/freetype2/src/cff/cffload.c:1588
#3 0x0000000000430d7b in cff_face_init (stream=0x6ada10, cffface=0x6ada70, face_index=0, num_params=0, params=0x0)
at /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
#4 0x000000000040645d in open_face (driver=0x6accb0, stream=0x6ada10, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe728)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#5 0x0000000000407abb in FT_Open_Face (library=0x6a8040, args=0x7fffffffe7a0, face_index=0, aface=0x7fffffffe8c0)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
#6 0x000000000040657a in FT_New_Face (library=0x6a8040, pathname=0x7fffffffec75 "sigsegv33.ttf", face_index=0, aface=0x7fffffffe8c0)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#7 0x000000000040235e in get_face (face=0x7fffffffe8c0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:624
#8 0x0000000000402662 in main (argc=1, argv=0x7fffffffe9e0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:752
(gdb) x/i $pc
=> 0x42e65a <cff_charset_compute_cids+239>: mov WORD PTR [rdx],ax
(gdb) p/x $rdx
$1 = 0xdd4e <-- probably controllable, definitely bigger than PAGE_SIZE, so not a very typical NULL-ptr deref
(gdb) p charset->cids
$4 = (FT_UShort *) 0x0
$ valgrind ./ftbench -c 1 sigsegv33.ttf
==932== Memcheck, a memory error detector
==932== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==932== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==932== Command: ./ftbench -c 1 sigsegv33.ttf
==932==
==932== Invalid write of size 2
==932== at 0x42E65A: cff_charset_compute_cids /usr/local/google/src/freetype2/src/cff/cffload.c:793
==932== by 0x42F0CF: cff_encoding_load /usr/local/google/src/freetype2/src/cff/cffload.c:1241
==932== by 0x42FCAF: cff_font_load /usr/local/google/src/freetype2/src/cff/cffload.c:1588
==932== by 0x430D7A: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
==932== by 0x40645C: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
==932== by 0x407ABA: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
==932== by 0x406579: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
==932== by 0x40235D: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:624
==932== by 0x402661: main /usr/local/google/src/freetype2-demos/src/ftbench.c:752
==932== Address 0xdd4e is not stack'd, malloc'd or (recently) free'd
==932==
==932==
==932== Process terminating with default action of signal 11 (SIGSEGV)
==932== Access not within mapped region at address 0xDD4E
==932== at 0x42E65A: cff_charset_compute_cids /usr/local/google/src/freetype2/src/cff/cffload.c:793
==932== by 0x42F0CF: cff_encoding_load /usr/local/google/src/freetype2/src/cff/cffload.c:1241
==932== by 0x42FCAF: cff_font_load /usr/local/google/src/freetype2/src/cff/cffload.c:1588
==932== by 0x430D7A: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
==932== by 0x40645C: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
==932== by 0x407ABA: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
==932== by 0x406579: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
==932== by 0x40235D: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:624
==932== by 0x402661: main /usr/local/google/src/freetype2-demos/src/ftbench.c:752
==932== If you believe this happened as a result of a stack
==932== overflow in your program's main thread (unlikely but
==932== possible), you can try to increase the size of the
==932== main thread stack using the --main-stacksize= flag.
==932== The main thread stack size used in this run was 8388608.
==932==
==932== HEAP SUMMARY:
==932== in use at exit: 51,046 bytes in 58 blocks
==932== total heap usage: 64 allocs, 6 frees, 54,206 bytes allocated
==932==
==932== LEAK SUMMARY:
==932== definitely lost: 0 bytes in 0 blocks
==932== indirectly lost: 0 bytes in 0 blocks
==932== possibly lost: 0 bytes in 0 blocks
==932== still reachable: 51,046 bytes in 58 blocks
==932== suppressed: 0 bytes in 0 blocks
==932== Rerun with --leak-check=full to see details of leaked memory
==932==
==932== For counts of detected and suppressed errors, rerun with: -v
==932== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 0)
|