bugThe FreeType Project - Bugs: bug #35659, Negative num_glyphs returned by...


You are not allowed to post comments on this tracker with your current authentication level.

bug #35659: Negative num_glyphs returned by FT_New_Face

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Tue 28 Feb 2012 10:37:33 AM UTC
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.4.9

Thu 01 Mar 2012 08:34:37 PM UTC, comment #1: 

Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Tue 28 Feb 2012 10:37:33 AM UTC, original submission:  

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

This particular issue is quite interesting, as it involves both freetype2 and the client application using it. For the sample which triggers the bug, the FT_New_Face function returns num_glyphs = -20. The value is later used to perform a memory allocation:

advanced = (FT_Fixed *)calloc( sizeof ( FT_Fixed ), face->num_glyphs );

and directly passes the pointer to FT_Get_Advances, even if the allocation failed and returned NULL. I believe that FT_New_Face returning a negative count of glyphs without an error might be a bug itself; I haven't done any investigation here, but depending on how controlled the num_glyphs field can be based on the source font, it might be possible to specially craft it to cause an integer overflow in an allocation like the one in ftbench, present in a real client application. This, in turn, might result in a memory corruption and an exploitable condition.

Log from Valgrind:

==20401== Memcheck, a memory error detector
==20401== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==20401== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==20401== Command: ./ftbench tmp/freetype_run2/cu12.fon.c95.437
Load                      :   inf us/op
Load_Advances (Normal)    : ==20401== Invalid write of size 8
==20401==    at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401==    by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401==    by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==20401== Process terminating with default action of signal 11 (SIGSEGV)
==20401==  Access not within mapped region at address 0x0
==20401==    at 0x403367: FT_Get_Advances (freetype2/src/base/ftadvanc.c:151)
==20401==    by 0x401853: test_load_advances (ft2demos-2.4.8/src/ftbench.c:245)
==20401==    by 0x4016B7: benchmark (ft2demos-2.4.8/src/ftbench.c:191)
==20401==    by 0x4027F4: main (ft2demos-2.4.8/src/ftbench.c:815)
==20401==  If you believe this happened as a result of a stack
==20401==  overflow in your program's main thread (unlikely but
==20401==  possible), you can try to increase the size of the
==20401==  main thread stack using the --main-stacksize= flag.
==20401==  The main thread stack size used in this run was 8388608.
==20401== HEAP SUMMARY:
==20401==     in use at exit: 30,988 bytes in 55 blocks
==20401==   total heap usage: 81 allocs, 26 frees, 42,786 bytes allocated
==20401== LEAK SUMMARY:
==20401==    definitely lost: 0 bytes in 0 blocks
==20401==    indirectly lost: 0 bytes in 0 blocks
==20401==      possibly lost: 0 bytes in 0 blocks
==20401==    still reachable: 30,988 bytes in 55 blocks
==20401==         suppressed: 0 bytes in 0 blocks
==20401== Rerun with --leak-check=full to see details of leaked memory
==20401== For counts of detected and suppressed errors, rerun with: -v
==20401== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)

Mateusz Jurczyk <j00ru>
Group Member


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #25205:  cu12.fon.c95.437 added by j00ru (7KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-03-01 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.4.9
    2012-02-28 j00ru Attached File- Added cu12.fon.c95.437, #25205

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code