bugThe FreeType Project - Bugs: bug #39266, NULL dereferences, etc. when OOM...

 
 

bug #39266: NULL dereferences, etc. when OOM while opening a font

Submitted by:  Andrew Church <achurch>
Submitted on:  Mon 17 Jun 2013 09:28:48 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 18 Jun 2013 07:37:00 AM UTC, comment #1:

Applied, with minor modifications to follow your recommendations. Thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 17 Jun 2013 09:28:48 AM UTC, original submission:

If memory allocations fail at certain points while opening a font, FreeType can either crash due to a NULL dereference or leak memory:

1) If open_face() (called from FT_Open_Face()), fails to allocate the face->internal structure, the driver (at least for TrueType fonts) will crash when it attempts to access face->stream->memory, since face->stream has not yet been initialized.

2) If FT_Open_Face() fails to allocate a node for the face object, freeing the face will fail because FT_Done_Face() expects the face to be in the driver's list.

3) If FT_Open_Face() fails in a memory allocation before the face's reference count is set to 1, a subsequent FT_Done_Library() call will loop over FT_Done_Face() 2^32 times before freeing the face. (FWIW, I recommend using signed instead of unsigned integers to avoid this general class of problems.)

4) In FT_Add_Module(), if ft_add_renderer() fails to allocate a node structure, the failure code path will crash when it attempts to dereference renderer->clazz.

The attached patch (against current git) fixes these problems.

Andrew Church <achurch>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #28331:  freetype-oom-fixes.diff added by achurch (2KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by achurch (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 18 Jun 2013 07:37:00 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5
    Mon 17 Jun 2013 09:28:48 AM UTCachurchAttached File-=>Added freetype-oom-fixes.diff, #28331

    Back to the top


    Powered by Savane 3.1-cleanup1