bugThe FreeType Project - Bugs: bug #30975, SIGSEGV (write) when processing a...

 
 

bug #30975: SIGSEGV (write) when processing a CFF font (charset->cids == NULL)

Submitted by:  Robert Swiecki <jagger>
Submitted on:  Mon 06 Sep 2010 01:33:23 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: suzuki toshiya <mpsuzuki>Open/Closed: Closed
Planned Release: 2.4.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 21 Sep 2010 03:35:09 PM UTC, comment #10:

Thanks!
Here I close this bug.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Tue 21 Sep 2010 03:01:19 PM UTC, comment #9:

Looks good, no problems under gdb nor valgrind.

Robert Swiecki <jagger>
Sun 19 Sep 2010 04:39:49 PM UTC, comment #8:

Just I've committed my patches to GIT.
Robert, could you check?

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Sun 19 Sep 2010 08:24:18 AM UTC, comment #7:

Looks good. Please proceed. And again, thanks for you work!

Werner LEMBERG <wl>
Project Administrator
Sat 18 Sep 2010 03:42:59 PM UTC, comment #6:

By trancating overrunning offset in cff_index_access_elemen()
(as broken `loca' case in TTF), the invalid i/o errors are fixed.
More serious check is needed to prevent to access the data
after CharString array, it needs some API refactoring.

(file #21485)

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Sat 18 Sep 2010 02:05:04 PM UTC, comment #5:

Attached patch includes:

  • fix the meaning of CFF_Charset->max_cid

from the size of CID array to real max CID.

  • ignore CID if it is greater than 0xFFFFU.
  • make verbose message for the truncation

when CFF charset is loaded.

SEGV issue is fixed, but shows many invalid
FT_Stream_EnterFrame(). They should be fixed
eitheer?

(file #21484)

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Sat 18 Sep 2010 10:18:04 AM UTC, comment #4:

Thank you for the analysis of the root of issue.
Either I could not find any 16-bit restriction of
CID in CFF spec nor CID-keyed font spec. What
I could find was PostScript Language Reference
Appendix B Table B.1 and PDF Reference Appendix
C Table C.1. It is questionable if we should
understand them as "PDL interpreter limitation"
or "font format limitation".

Checking the current implementation of TrueType
cmap format 8, 10 and 12, the glyph index are
validated to be fitting in maxGID defined by maxp,
and forcibly casted to FT_ULong to FT_UInt.

At present, CFF driver does not have the validator.
I will add the error messages to warn the glyphs
with CID > 0xFFFF are ignored.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Wed 15 Sep 2010 09:05:41 AM UTC, comment #3:

s/max_sid/max_cid/

Werner LEMBERG <wl>
Project Administrator
Wed 15 Sep 2010 09:03:54 AM UTC, comment #2:

This could be easily fixed by changing the type of `charset->max_sid' (and the local variable `max_cid' in cff_charset_compute_cids) from UShort/UInt to ULong so that `max_cid++' doesn't overflow. However, I'm not sure whether this is the correct solution, that is, allowing CID values from 0 to 0xFFFF inclusive. I vaguely remember that there are restrictions in the CFF specification but I haven't found something after a quick search. On the other hand, why not allowing the whole UShort range?

Werner LEMBERG <wl>
Project Administrator
Wed 15 Sep 2010 05:56:29 AM UTC, comment #1:

I could reproduced on GNU/Linux on amd64.

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Mon 06 Sep 2010 01:33:23 PM UTC, original submission:

File: http://alt.swiecki.net/j/f/sigsegv33.ttf
Platform: Linux/amd64

$ gdb ./ftbench
(gdb) r -c 1 sigsegv33.ttf

Program received signal SIGSEGV, Segmentation fault.
0x000000000042e65a in cff_charset_compute_cids (charset=0x6af630, num_glyphs=676, memory=0x6a8010) at /usr/local/google/src/freetype2/src/cff/cffload.c:793
793 charset->cids[charset->sids[j]] = (FT_UShort)j;
(gdb) bt
#0 0x000000000042e65a in cff_charset_compute_cids (charset=0x6af630, num_glyphs=676, memory=0x6a8010)
at /usr/local/google/src/freetype2/src/cff/cffload.c:793
#1 0x000000000042f0d0 in cff_encoding_load (encoding=0x6af218, charset=0x6af630, num_glyphs=676, stream=0x6ada10, base_offset=4068, offset=0)
at /usr/local/google/src/freetype2/src/cff/cffload.c:1241
#2 0x000000000042fcb0 in cff_font_load (library=0x6a8040, stream=0x6ada10, face_index=0, font=0x6af150, pure_cff=0 '\000')
at /usr/local/google/src/freetype2/src/cff/cffload.c:1588
#3 0x0000000000430d7b in cff_face_init (stream=0x6ada10, cffface=0x6ada70, face_index=0, num_params=0, params=0x0)
at /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
#4 0x000000000040645d in open_face (driver=0x6accb0, stream=0x6ada10, face_index=0, num_params=0, params=0x0, aface=0x7fffffffe728)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
#5 0x0000000000407abb in FT_Open_Face (library=0x6a8040, args=0x7fffffffe7a0, face_index=0, aface=0x7fffffffe8c0)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
#6 0x000000000040657a in FT_New_Face (library=0x6a8040, pathname=0x7fffffffec75 "sigsegv33.ttf", face_index=0, aface=0x7fffffffe8c0)
at /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
#7 0x000000000040235e in get_face (face=0x7fffffffe8c0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:624
#8 0x0000000000402662 in main (argc=1, argv=0x7fffffffe9e0) at /usr/local/google/src/freetype2-demos/src/ftbench.c:752

(gdb) x/i $pc
=> 0x42e65a <cff_charset_compute_cids+239>: mov WORD PTR [rdx],ax

(gdb) p/x $rdx
$1 = 0xdd4e <-- probably controllable, definitely bigger than PAGE_SIZE, so not a very typical NULL-ptr deref

(gdb) p charset->cids
$4 = (FT_UShort *) 0x0

$ valgrind ./ftbench -c 1 sigsegv33.ttf
==932== Memcheck, a memory error detector
==932== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==932== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info
==932== Command: ./ftbench -c 1 sigsegv33.ttf
==932==
==932== Invalid write of size 2
==932== at 0x42E65A: cff_charset_compute_cids /usr/local/google/src/freetype2/src/cff/cffload.c:793
==932== by 0x42F0CF: cff_encoding_load /usr/local/google/src/freetype2/src/cff/cffload.c:1241
==932== by 0x42FCAF: cff_font_load /usr/local/google/src/freetype2/src/cff/cffload.c:1588
==932== by 0x430D7A: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
==932== by 0x40645C: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
==932== by 0x407ABA: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
==932== by 0x406579: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
==932== by 0x40235D: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:624
==932== by 0x402661: main /usr/local/google/src/freetype2-demos/src/ftbench.c:752
==932== Address 0xdd4e is not stack'd, malloc'd or (recently) free'd
==932==
==932==
==932== Process terminating with default action of signal 11 (SIGSEGV)
==932== Access not within mapped region at address 0xDD4E
==932== at 0x42E65A: cff_charset_compute_cids /usr/local/google/src/freetype2/src/cff/cffload.c:793
==932== by 0x42F0CF: cff_encoding_load /usr/local/google/src/freetype2/src/cff/cffload.c:1241
==932== by 0x42FCAF: cff_font_load /usr/local/google/src/freetype2/src/cff/cffload.c:1588
==932== by 0x430D7A: cff_face_init /usr/local/google/src/freetype2/src/cff/cffobjs.c:537
==932== by 0x40645C: open_face /usr/local/google/src/freetype2/src/base/ftobjs.c:1134
==932== by 0x407ABA: FT_Open_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:2046
==932== by 0x406579: FT_New_Face /usr/local/google/src/freetype2/src/base/ftobjs.c:1196
==932== by 0x40235D: get_face /usr/local/google/src/freetype2-demos/src/ftbench.c:624
==932== by 0x402661: main /usr/local/google/src/freetype2-demos/src/ftbench.c:752
==932== If you believe this happened as a result of a stack
==932== overflow in your program's main thread (unlikely but
==932== possible), you can try to increase the size of the
==932== main thread stack using the --main-stacksize= flag.
==932== The main thread stack size used in this run was 8388608.
==932==
==932== HEAP SUMMARY:
==932== in use at exit: 51,046 bytes in 58 blocks
==932== total heap usage: 64 allocs, 6 frees, 54,206 bytes allocated
==932==
==932== LEAK SUMMARY:
==932== definitely lost: 0 bytes in 0 blocks
==932== indirectly lost: 0 bytes in 0 blocks
==932== possibly lost: 0 bytes in 0 blocks
==932== still reachable: 51,046 bytes in 58 blocks
==932== suppressed: 0 bytes in 0 blocks
==932== Rerun with --leak-check=full to see details of leaked memory
==932==
==932== For counts of detected and suppressed errors, rerun with: -v
==932== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 0)

Robert Swiecki <jagger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21485:  bug30975_20100919a.diff added by mpsuzuki (745B - text/x-patch)
file #21484:  bug30975_20100918b.diff added by mpsuzuki (3KiB - text/x-patch)
file #21395:  sigsegv33.ttf added by jagger (166KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by mpsuzuki (Posted a comment)
  • -unavailable- added by jagger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 10 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 21 Sep 2010 03:35:08 PM UTCmpsuzukiStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.3
    Sun 19 Sep 2010 04:39:49 PM UTCmpsuzukiStatusIn Progress=>Ready For Test
    Sat 18 Sep 2010 03:42:59 PM UTCmpsuzukiAttached File-=>Added bug30975_20100919a.diff, #21485
      StatusConfirmed=>In Progress
    Sat 18 Sep 2010 02:05:04 PM UTCmpsuzukiAttached File-=>Added bug30975_20100918b.diff, #21484
    Wed 15 Sep 2010 05:56:29 AM UTCmpsuzukiStatusNone=>Confirmed
      Assigned toNone=>mpsuzuki
    Mon 06 Sep 2010 01:33:23 PM UTCjaggerAttached File-=>Added sigsegv33.ttf, #21395

    Back to the top


    Powered by Savane 3.1-cleanup1