Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

This particular issue is quite interesting, as it involves both freetype2 and the client application using it. For the sample which triggers the bug, the FT_New_Face function returns num_glyphs = -20. The value is later used to perform a memory allocation:

advanced = (FT_Fixed *)calloc( sizeof ( FT_Fixed ), face->num_glyphs );

and directly passes the pointer to FT_Get_Advances, even if the allocation failed and returned NULL. I believe that FT_New_Face returning a negative count of glyphs without an error might be a bug itself; I haven't done any investigation here, but depending on how controlled the num_glyphs field can be based on the source font, it might be possible to specially craft it to cause an integer overflow in an allocation like the one in ftbench, present in a real client application. This, in turn, might result in a memory corruption and an exploitable condition.


Log from Valgrind:

==20401== Memcheck, a memory error detector
==20401== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==20401== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==20401== Command: ./ftbench tmp/freetype_run2/cu12.fon.c95.437
==20401==
Load                      :   inf us/op
Load_Advances (Normal)    : ==20401== Invalid write of size 8
==20401==    at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401==    by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401==    by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==20401==
==20401==
==20401== Process terminating with default action of signal 11 (SIGSEGV)
==20401==  Access not within mapped region at address 0x0
==20401==    at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401==    by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401==    by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401==  If you believe this happened as a result of a stack
==20401==  overflow in your program's main thread (unlikely but
==20401==  possible), you can try to increase the size of the
==20401==  main thread stack using the --main-stacksize= flag.
==20401==  The main thread stack size used in this run was 8388608.
==20401==
==20401== HEAP SUMMARY:
==20401==     in use at exit: 30,988 bytes in 55 blocks
==20401==   total heap usage: 81 allocs, 26 frees, 42,786 bytes allocated
==20401==
==20401== LEAK SUMMARY:
==20401==    definitely lost: 0 bytes in 0 blocks
==20401==    indirectly lost: 0 bytes in 0 blocks
==20401==      possibly lost: 0 bytes in 0 blocks
==20401==    still reachable: 30,988 bytes in 55 blocks
==20401==         suppressed: 0 bytes in 0 blocks
==20401== Rerun with --leak-check=full to see details of leaked memory
==20401==
==20401== For counts of detected and suppressed errors, rerun with: -v
==20401== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)