bugThe FreeType Project - Bugs: bug #35660, Division by zero in cff_face_init...

 
 

bug #35660: Division by zero in cff_face_init => FT_DivFix

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Tue 28 Feb 2012 11:28:13 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.9

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 04 Mar 2012 11:03:03 AM UTC, comment #2:

The crash no longer occurs, seems OK. Also, and as expected, I've been unable to find any more issues at this time, so there are no more upcoming reports from me. Thanks for your prompt fixes.

Mateusz Jurczyk <j00ru>
Project Member
Sat 03 Mar 2012 11:36:48 AM UTC, comment #1:

This should be fixed now. Please test the current git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 28 Feb 2012 11:28:13 AM UTC, original submission:

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Because of the nature of the vulnerability (64-to-32 bit integer truncation), the issue might only be reproducible on 64-bit platforms.

Crashlog:

(gdb) r tmp/freetype_run2/30000.11181.otf.9f7.35
Starting program: ft2demos-2.4.8/bin/ftbench tmp/freetype_run2/30000.11181.otf.9f7.35
tt_face_build_cmaps: broken cmap sub-table ignored
tt_face_build_cmaps: broken cmap sub-table ignored

Program received signal SIGFPE, Arithmetic exception.
0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000) at freetype2/src/base/ftcalc.c:555
555 q = (FT_UInt32)( (a << 16) + (b >> 1) ) / (FT_UInt32)b;
(gdb) where
#0 0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000)
at freetype2/src/base/ftcalc.c:555
#1 0x0000000000437ae7 in cff_face_init (stream=0x6ce960, cffface=0x6cec00, face_index=0, num_params=0, params=0x0)
at freetype2/src/cff/cffobjs.c:659
#2 0x0000000000407f70 in open_face (driver=0x6cdd70, stream=0x6ce960, face_index=0, num_params=0, params=0x0,
aface=0x7fffffffe108) at freetype2/src/base/ftobjs.c:1153
#3 0x00000000004097f4 in FT_Open_Face (library=0x6c9040, args=0x7fffffffe180, face_index=0, aface=0x7fffffffe2a0)
at freetype2/src/base/ftobjs.c:2080
#4 0x000000000040808d in FT_New_Face (library=0x6c9040,
pathname=0x7fffffffe654 "tmp/freetype_run2/30000.11181.otf.9f7.35", face_index=0,
aface=0x7fffffffe2a0) at freetype2/src/base/ftobjs.c:1215
#5 0x0000000000402303 in get_face (face=0x7fffffffe2a0) at src/ftbench.c:624
#6 0x00000000004025f5 in main (argc=1, argv=0x7fffffffe3b0) at src/ftbench.c:752
(gdb)

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #25206:  30000.11181.otf.9f7.35 added by j00ru (244KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 03 Mar 2012 11:36:48 AM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.9
    Tue 28 Feb 2012 11:28:13 AM UTCj00ruAttached File-=>Added 30000.11181.otf.9f7.35, #25206

    Back to the top


    Powered by Savane 3.1-cleanup1