The FreeType Project - Bugs: bug #35656, Static out-of-bounds read in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #35656: Static out-of-bounds read in _bdf_parse_glyphs
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Tue 28 Feb 2012 10:04:14 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.4.9 |
( Jump to the original submission )
Tue 20 Mar 2012 02:04:10 PM UTC, comment #7: |
Alexei Podtelezhnikov <podtelez>![]() |
Tue 20 Mar 2012 06:23:45 AM UTC, comment #6: I've changed the code accordingly. Thanks! |
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Mar 2012 09:28:54 PM UTC, comment #5: My proposal was to change isdigok() to:
|
Tomas Hoger <thoger> |
Mon 19 Mar 2012 06:39:08 PM UTC, comment #4: Tomas,
|
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Mar 2012 03:06:49 PM UTC, comment #3: Interesting... no, I am no longer able to reproduce the issue with the two old samples and an ASAN build. |
Mateusz Jurczyk <j00ru>![]() |
Mon 19 Mar 2012 02:13:28 PM UTC, comment #2: Mateusz, have you been able to test the fix for this issue using ASAN? It seems the fix still has a problem. As c and line[] are (signed) char and isdigok() has "m[(d) >> 3]", the fix should still allow (smaller) hdigits[] underflow. To test that I did a quick hack of the code to use heap alloced hdigits[] instead of data segment and got valgrind to report those underflows on Mateusz's test cases.
|
Tomas Hoger <thoger> |
Thu 01 Mar 2012 08:34:15 PM UTC, comment #1: Hopefully, this is fixed in git now. Please test. |
Werner LEMBERG <wl>![]() ![]() |
Tue 28 Feb 2012 10:04:14 AM UTC, original submission:
Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).
|
Mateusz Jurczyk <j00ru>![]() |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 8 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2012-03-19 | thoger | Attached File | - | ![]() |
Added isdigok-debug.diff, #25410 |
2012-03-01 | wl | Status | None | ![]() |
Fixed |
Privacy | Private | ![]() |
Public | ||
Assigned to | None | ![]() |
wl | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.4.9 | ||
2012-02-28 | j00ru | Attached File | - | ![]() |
Added jiskan16-16.bdf.asan.49.633, #25201 |
Attached File | - | ![]() |
Added nethack12B.bdf.asan.4.761, #25202 |
Do we need two identical macros in the same file?
Line 428:
#define sbitset( m, cc ) \
( m[(FT_Byte)(cc) >> 3] & ( 1 << ( (cc) & 7 ) ) )
Line 845:
#define isdigok( m, d ) (m[(unsigned char)(d) >> 3] & ( 1 << ( (d) & 7 ) ) )
I do also like FT_Byte more than unsigned char.