bugThe FreeType Project - Bugs: bug #37350, Out-of-bounds read in...

 
 

bug #37350: Out-of-bounds read in T1_Get_Private_Dict

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Fri 14 Sep 2012 11:53:03 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.11

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 17 Sep 2012 07:00:50 PM UTC, comment #1:

Fixed in git. Thanks for the report!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 14 Sep 2012 11:53:03 AM UTC, original submission:

Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

=================================================================
==19460== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7f43ebd58bb0 at pc 0x4eb206 bp 0x7fff58e736f0 sp 0x7fff58e736e8
READ of size 1 at 0x7f43ebd58bb0 thread T0
#0 0x4eb205 in T1_Get_Private_Dict /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1parse.c:444
#1 0x4e7370 in T1_Open_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1load.c:2115
#2 0x4e09f5 in T1_Face_Init /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#3 0x49c748 in open_face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:1154
#4 0x49b51e in FT_Open_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:2082
#5 0x49c3d9 in FT_New_Memory_Face /proc/self/cwd/third_party/freetype2/freetype-2.4.9/src/base/ftobjs.c:1243
#6 0x49278f in get_face /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:621
#7 0x493008 in main /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:752
#8 0x7f43ed1a1d5c in __libc_start_main ??:0
0x7f43ebd58bb0 is located 0 bytes to the right of 2864-byte region [0x7f43ebd58080,0x7f43ebd58bb0)
allocated by thread T0 here:
#0 0x5d0d90 in __interceptor_malloc /proc/self/cwd/third_party/address_sanitizer/asan/asan_malloc_linux.cc:72
#1 0x4926de in get_face /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:603
#2 0x493008 in main /proc/self/cwd/third_party/freetype2/ft2demos-2.4.8/src/ftbench.c:752
#3 0x7f43ed1a1d5c in __libc_start_main ??:0
Shadow byte and word:
0x1fe87d7ab176: fb
0x1fe87d7ab170: 00 00 00 00 00 00 fb fb
More shadow bytes:
0x1fe87d7ab150: 00 00 00 00 00 00 00 00
0x1fe87d7ab158: 00 00 00 00 00 00 00 00
0x1fe87d7ab160: 00 00 00 00 00 00 00 00
0x1fe87d7ab168: 00 00 00 00 00 00 00 00
=>0x1fe87d7ab170: 00 00 00 00 00 00 fb fb
0x1fe87d7ab178: fb fb fb fb fb fb fb fb
0x1fe87d7ab180: fa fa fa fa fa fa fa fa
0x1fe87d7ab188: fa fa fa fa fa fa fa fa
0x1fe87d7ab190: fa fa fa fa fa fa fa fa
Stats: 0M malloced (0M for red zones) by 708 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 18 calls
Stats: 0M really freed by 0 calls
Stats: 24M (6146 full pages) mmaped in 6 calls
mmaps by size class: 8:16383; 9:8191; 10:4095; 11:2047; 12:1024; 15:128;
mallocs by size class: 8:682; 9:17; 10:3; 11:4; 12:1; 15:1;
frees by size class: 8:16; 10:1; 11:1;
rfrees by size class:
Stats: malloc large: 0 small slow: 7
==19460== ABORTING

Testcase attached.

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #26554:  font.bin added by j00ru (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 17 Sep 2012 07:00:50 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.11
    Fri 14 Sep 2012 11:53:03 AM UTCj00ruAttached File-=>Added font.bin, #26554

    Back to the top


    Powered by Savane 3.1-cleanup1