bugThe FreeType Project - Bugs: bug #35603, Out-of-bounds read in strlen, pcf...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35603: Out-of-bounds read in strlen, pcf parsing

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Thu 23 Feb 2012 12:52:02 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.9

Sun 26 Feb 2012 07:17:52 AM UTC, comment #1: 

Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Thu 23 Feb 2012 12:52:02 PM UTC, original submission:  

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

=================================================================
==30715== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7fddf0e6e587 at pc 0x5c51cf bp 0x7fff62723d00 sp 0x7fff62723ce8
READ of size 1 at 0x7fddf0e6e587 thread T0
  #0 0x5c51cf strlen
  #1 0x4a3384 ft_mem_strdup
  #2 0x576f43 pcf_get_properties
  #3 0x57549d pcf_load_font
  #4 0x573a74 PCF_Face_Init
  #5 0x4913e0 open_face
  #6 0x4909a3 FT_Open_Face
  #7 0x48fd06 FT_New_Face
  #8 0x487557 get_face
  #9 0x487cb1 main
  #10 0x7fddf12b2d5d __libc_start_main
0x7fddf0e6e587 is located 0 bytes to the right of 263-byte region [0x7fddf0e6e480,0x7fddf0e6e587)
allocated by thread T0 here:
  #0 0x5c3222 malloc
  #1 0x4a0434 ft_mem_qalloc
  #2 0x48b3cf ft_mem_alloc
  #3 0x4a3012 ft_mem_qrealloc
  #4 0x48bccd ft_mem_realloc
  #5 0x576d3f pcf_get_properties
  #6 0x57549d pcf_load_font
  #7 0x573a74 PCF_Face_Init
  #8 0x4913e0 open_face
  #9 0x4909a3 FT_Open_Face
  #10 0x48fd06 FT_New_Face
  #11 0x487557 get_face
  #12 0x487cb1 main
  #13 0x7fddf12b2d5d __libc_start_main
==30715== ABORTING
Stats: 0M malloced (0M for red zones) by 726 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 24 calls
Stats: 0M really freed by 0 calls
Stats: 24M (6146 full pages) mmaped in 6 calls
  mmaps   by size class: 8:16383; 9:8191; 10:4095; 11:2047; 13:512; 15:128;
  mallocs by size class: 8:691; 9:20; 10:8; 11:5; 13:1; 15:1;
  frees   by size class: 8:14; 9:2; 10:5; 11:2; 13:1;
  rfrees  by size class:
Stats: malloc large: 0 small slow: 7
Shadow byte and word:
  0x1ffbbe1cdcb0: 7
  0x1ffbbe1cdcb0: 07 fb fb fb fb fb fb fb
More shadow bytes:
  0x1ffbbe1cdc90: 00 00 00 00 00 00 00 00
  0x1ffbbe1cdc98: 00 00 00 00 00 00 00 00
  0x1ffbbe1cdca0: 00 00 00 00 00 00 00 00
  0x1ffbbe1cdca8: 00 00 00 00 00 00 00 00
=>0x1ffbbe1cdcb0: 07 fb fb fb fb fb fb fb
  0x1ffbbe1cdcb8: fb fb fb fb fb fb fb fb
  0x1ffbbe1cdcc0: fa fa fa fa fa fa fa fa
  0x1ffbbe1cdcc8: fa fa fa fa fa fa fa fa
  0x1ffbbe1cdcd0: fa fa fa fa fa fa fa fa


Valgrind log:

==30632== Memcheck, a memory error detector
==30632== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==30632== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==30632== Command: ./a.out tmp/freetype/8x13B-ISO8859-8.pcf.asan.5f.71
==30632==
==30632== Invalid read of size 1
==30632==    at 0x4C2C464: __GI_strlen (memcheck/mc_replace_strmem.c:391)
==30632==    by 0x407C1A: ft_mem_strdup (freetype2/freetype-2.4.8/src/base/ftutil.c:198)
==30632==    by 0x4309CC: pcf_load_font (freetype2/freetype-2.4.8/src/pcf/pcfread.c:542)
==30632==    by 0x43137D: PCF_Face_Init (freetype2/freetype-2.4.8/src/pcf/pcfdrivr.c:277)
==30632==    by 0x4089B7: open_face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1149)
==30632==    by 0x40B362: FT_Open_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:2076)
==30632==    by 0x40C58A: FT_New_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1211)
==30632==    by 0x40235C: get_face (freetype2/ft2demos-2.4.8/src/ftbench.c:624)
==30632==    by 0x402660: main (freetype2/ft2demos-2.4.8/src/ftbench.c:752)
==30632==  Address 0x53d84e7 is 0 bytes after a block of size 263 alloc'd
==30632==    at 0x4C2A4D6: malloc (coregrind/m_replacemalloc/vg_replace_malloc.c:263)
==30632==    by 0x406CBF: ft_mem_qalloc (freetype2/freetype-2.4.8/src/base/ftutil.c:76)
==30632==    by 0x4082D2: ft_mem_alloc (freetype2/freetype-2.4.8/src/base/ftutil.c:55)
==30632==    by 0x408404: ft_mem_qrealloc (freetype2/freetype-2.4.8/src/base/ftutil.c:145)
==30632==    by 0x408CCA: ft_mem_realloc (freetype2/freetype-2.4.8/src/base/ftutil.c:101)
==30632==    by 0x430871: pcf_load_font (freetype2/freetype-2.4.8/src/pcf/pcfread.c:499)
==30632==    by 0x43137D: PCF_Face_Init (freetype2/freetype-2.4.8/src/pcf/pcfdrivr.c:277)
==30632==    by 0x4089B7: open_face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1149)
==30632==    by 0x40B362: FT_Open_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:2076)
==30632==    by 0x40C58A: FT_New_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1211)
==30632==    by 0x40235C: get_face (freetype2/ft2demos-2.4.8/src/ftbench.c:624)
==30632==    by 0x402660: main (freetype2/ft2demos-2.4.8/src/ftbench.c:752)
==30632==
==30632== Invalid read of size 2
==30632==    at 0x4C2D24C: memcpy (memcheck/mc_replace_strmem.c:838)
==30632==    by 0x407BE1: ft_mem_dup (/usr/include/bits/string3.h:52)
==30632==    by 0x4309CC: pcf_load_font (freetype2/freetype-2.4.8/src/pcf/pcfread.c:542)
==30632==    by 0x43137D: PCF_Face_Init (freetype2/freetype-2.4.8/src/pcf/pcfdrivr.c:277)
==30632==    by 0x4089B7: open_face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1149)
==30632==    by 0x40B362: FT_Open_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:2076)
==30632==    by 0x40C58A: FT_New_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1211)
==30632==    by 0x40235C: get_face (freetype2/ft2demos-2.4.8/src/ftbench.c:624)
==30632==    by 0x402660: main (freetype2/ft2demos-2.4.8/src/ftbench.c:752)
==30632==  Address 0x53d84e6 is 262 bytes inside a block of size 263 alloc'd
==30632==    at 0x4C2A4D6: malloc (coregrind/m_replacemalloc/vg_replace_malloc.c:263)
==30632==    by 0x406CBF: ft_mem_qalloc (freetype2/freetype-2.4.8/src/base/ftutil.c:76)
==30632==    by 0x4082D2: ft_mem_alloc (freetype2/freetype-2.4.8/src/base/ftutil.c:55)
==30632==    by 0x408404: ft_mem_qrealloc (freetype2/freetype-2.4.8/src/base/ftutil.c:145)
==30632==    by 0x408CCA: ft_mem_realloc (freetype2/freetype-2.4.8/src/base/ftutil.c:101)
==30632==    by 0x430871: pcf_load_font (freetype2/freetype-2.4.8/src/pcf/pcfread.c:499)
==30632==    by 0x43137D: PCF_Face_Init (freetype2/freetype-2.4.8/src/pcf/pcfdrivr.c:277)
==30632==    by 0x4089B7: open_face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1149)
==30632==    by 0x40B362: FT_Open_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:2076)
==30632==    by 0x40C58A: FT_New_Face (freetype2/freetype-2.4.8/src/base/ftobjs.c:1211)
==30632==    by 0x40235C: get_face (freetype2/ft2demos-2.4.8/src/ftbench.c:624)
==30632==    by 0x402660: main (freetype2/ft2demos-2.4.8/src/ftbench.c:752)
==30632==
couldn't load font resource
==30632==
==30632== HEAP SUMMARY:
==30632==     in use at exit: 0 bytes in 0 blocks
==30632==   total heap usage: 107 allocs, 107 frees, 56,149 bytes allocated
==30632==
==30632== All heap blocks were freed -- no leaks are possible
==30632==
==30632== For counts of detected and suppressed errors, rerun with: -v
==30632== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 4 from 4)

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #25137:  8x13O-ISO8859-10.pcf.asan.5f.73 added by j00ru (17KiB - application/octet-stream - Other files reproducing the issue (different strdup calls).)
file #25138:  9x18B.pcf.asan.52.109 added by j00ru (205KiB - application/octet-stream - Other files reproducing the issue (different strdup calls).)
file #25139:  timBI14.pcf.asan.52.823 added by j00ru (74KiB - application/octet-stream - Other files reproducing the issue (different strdup calls).)
file #25136:  8x13B-ISO8859-8.pcf.asan.5f.71 added by j00ru (16KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Updated the item)
  • -email is unavailable- added by j00ru (Submitted the item)
  • -email is unavailable- added by j00ru
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-02-26 wl StatusNone Fixed
        PrivacyPrivate Public
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.9
    2012-02-25 wl Assigned toNone wl
    2012-02-23 j00ru Attached File- Added 8x13O-ISO8859-10.pcf.asan.5f.73, #25137
        Attached File- Added 9x18B.pcf.asan.52.109, #25138
        Attached File- Added timBI14.pcf.asan.52.823, #25139
    2012-02-23 j00ru Attached File- Added 8x13B-ISO8859-8.pcf.asan.5f.71, #25136
        Carbon-Copy- Added j00ru

    Back to the top

    Powered by Savane 3.14-21bf.
    Corresponding source code