bugThe FreeType Project - Bugs: bug #35609, Out-of-bounds read in...

 
 

bug #35609: Out-of-bounds read in _bdf_parse_glyphs (3)

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Thu 23 Feb 2012 01:45:08 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.9

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 27 Feb 2012 09:05:51 PM UTC, comment #7:

Thanks, so I'm closing it as fixed.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 27 Feb 2012 03:59:35 PM UTC, comment #6:

Hmm, I cannot reproduce the bug with ASAN or Valgrind with the current git anymore, either.

Mateusz Jurczyk <j00ru>
Project Member
Sat 25 Feb 2012 12:39:02 PM UTC, comment #5:

Again a bug which I can't reproduce :-(

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 25 Feb 2012 12:32:09 PM UTC, comment #4:

I've downloaded it, thanks. The file is apparently too large to be attached to this bug report...

I'm trying to attached it in compressed form.

(file #25161)

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 25 Feb 2012 12:25:10 PM UTC, comment #3:

For unknown reasons, I am unable to upload the sample. Please find it here: http://j00ru.vexillium.org/dump/cns5-40.bdf.asan.e.381

Mateusz Jurczyk <j00ru>
Project Member
Sat 25 Feb 2012 12:19:24 PM UTC, comment #2:

Oh, sorry, testcase attached.

Mateusz Jurczyk <j00ru>
Project Member
Sat 25 Feb 2012 09:22:09 AM UTC, comment #1:

Please provide a test font.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 23 Feb 2012 01:45:08 PM UTC, original submission:

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Note: Strangely enough, this issue is only detected by ASAN in my tests; valgrind does not raise any objections.

Log from ASAN build:

=================================================================
==4403== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7f5a3ae8d3a0 at pc 0x571b5e bp 0x7fffb7e1be10 sp 0x7fffb7e1be08
READ of size 8 at 0x7f5a3ae8d3a0 thread T0
#0 0x571b5e _bdf_parse_glyphs
#1 0x56a876 _bdf_readstream
#2 0x568a19 bdf_load_font
#3 0x565aad BDF_Face_Init
#4 0x4913e0 open_face
#5 0x4909a3 FT_Open_Face
#6 0x48fd06 FT_New_Face
#7 0x487557 get_face
#8 0x487cb1 main
#9 0x7f5a3bed7d5d __libc_start_main
0x7f5a3ae8d3a0 is located 4784 bytes to the right of 16496-byte region [0x7f5a3ae88080,0x7f5a3ae8c0f0)
allocated by thread T0 here:
#0 0x5c3222 malloc
#1 0x4a0434 ft_mem_qalloc
#2 0x48b3cf ft_mem_alloc
#3 0x56893c bdf_load_font
#4 0x565aad BDF_Face_Init
#5 0x4913e0 open_face
#6 0x4909a3 FT_Open_Face
#7 0x48fd06 FT_New_Face
#8 0x487557 get_face
#9 0x487cb1 main
#10 0x7f5a3bed7d5d __libc_start_main
==4403== ABORTING
Stats: 0M malloced (0M for red zones) by 836 calls
Stats: 0M realloced by 3 calls
Stats: 0M freed by 31 calls
Stats: 0M really freed by 0 calls
Stats: 36M (9221 full pages) mmaped in 9 calls
mmaps by size class: 8:16383; 9:8191; 10:4095; 11:2047; 12:1024; 13:512; 15:128; 16:64; 19:8;
mallocs by size class: 8:792; 9:23; 10:7; 11:6; 12:3; 13:1; 15:2; 16:1; 19:1;
frees by size class: 8:18; 9:3; 10:6; 11:2; 12:1; 13:1;
rfrees by size class:
Stats: malloc large: 1 small slow: 9
Shadow byte and word:
0x1feb475d1a74: fa
0x1feb475d1a70: fa fa fa fa fa fa fa fa
More shadow bytes:
0x1feb475d1a50: fa fa fa fa fa fa fa fa
0x1feb475d1a58: fa fa fa fa fa fa fa fa
0x1feb475d1a60: fa fa fa fa fa fa fa fa
0x1feb475d1a68: fa fa fa fa fa fa fa fa
=>0x1feb475d1a70: fa fa fa fa fa fa fa fa
0x1feb475d1a78: fa fa fa fa fa fa fa fa
0x1feb475d1a80: fa fa fa fa fa fa fa fa
0x1feb475d1a88: fa fa fa fa fa fa fa fa
0x1feb475d1a90: fa fa fa fa fa fa fa fa

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #25161:  cns5-40.bdf.asan.e.381.xz added by wl (704KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 27 Feb 2012 09:05:51 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.9
    Sat 25 Feb 2012 01:23:58 PM UTCwlAssigned toNone=>wl
    Sat 25 Feb 2012 12:32:09 PM UTCwlAttached File-=>Added cns5-40.bdf.asan.e.381.xz, #25161

    Back to the top


    Powered by Savane 3.1-cleanup1