bugThe FreeType Project - Bugs: bug #41309, Use of uninitialized memory in...

 
 

bug #41309: Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Wed 22 Jan 2014 07:42:09 PM UTC  
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  2.5.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 23 Jan 2014 07:15:58 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 22 Jan 2014 07:42:09 PM UTC, original submission:

There are three different use-of-uninitialized-memory conditions in psobjs.c, t42parse.c and t1load.c.
All of them have been reproduced with ftbench (with the -p command line option) compiled on Ubuntu amd64.

While only MSan log messages are shown below, the issues can also be reproduced with valgrind (confirmed), though with less informative warning messages.

MemorySanitizer logs:

==14397== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f5e51ed20e7 in FT_RoundFix freetype2/src/base/ftcalc.c:78
#1 0x7f5e527ddecc in ps_parser_load_field freetype2/src/psaux/psobjs.c:1213
#2 0x7f5e5238b1d2 in t42_load_keyword freetype2/src/type42/t42parse.c:1014
#3 0x7f5e5238820f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
#4 0x7f5e5237ef9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
#5 0x7f5e5236f576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
#6 0x7f5e51f11d70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f5e51f0b3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f5e51f0f6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f5e51eb21c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f5e51eade2f in main ft2demos-2.5.2/src/ftbench.c:918

Uninitialized value was created by an allocation of 'temp' in the stack frame of function 'ps_parser_load_field'
#0 0x7f5e527d9a30 in ps_parser_load_field freetype2/src/psaux/psobjs.c:1029

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:78 FT_RoundFix
---------------------------------------------------------------------------------------------------------------------
==14517== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f93585fa1bf in FT_DivFix freetype2/src/base/ftcalc.c:560
#1 0x7f9358aab481 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:276
#2 0x7f9358aa956a in t42_load_keyword freetype2/src/type42/t42parse.c:981
#3 0x7f9358aa720f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
#4 0x7f9358a9df9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
#5 0x7f9358a8e576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
#6 0x7f9358630d70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f935862a3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f935862e6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f93585d11c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f93585cce2f in main ft2demos-2.5.2/src/ftbench.c:918

Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't42_parse_font_matrix'
#0 0x7f9358aaa2a0 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:251

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix
---------------------------------------------------------------------------------------------------------------------
==14283== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f7a67d141bf in FT_DivFix freetype2/src/base/ftcalc.c:560
#1 0x7f7a67faca07 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1137
#2 0x7f7a67fa9964 in t1_load_keyword freetype2/src/type1/t1load.c:932
#3 0x7f7a67f9c829 in parse_dict freetype2/src/type1/t1load.c:1996
#4 0x7f7a67f8a035 in T1_Open_Face freetype2/src/type1/t1load.c:2104
#5 0x7f7a67f5efbe in T1_Face_Init freetype2/src/type1/t1objs.c:339
#6 0x7f7a67d4ad70 in open_face freetype2/src/base/ftobjs.c:1191
#7 0x7f7a67d443f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
#8 0x7f7a67d486ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
#9 0x7f7a67ceb1c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
#10 0x7f7a67ce6e2f in main ft2demos-2.5.2/src/ftbench.c:918

Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't1_parse_font_matrix'
#0 0x7f7a67fab460 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1098

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #30344:  msan_uninit-mem_7ffcbb6681bf_2488_Verdana.pfr added by j00ru (84KiB - application/octet-stream)
file #30345:  msan_uninit-mem_7f13afca61bf_3006_bin01st.t42 added by j00ru (70KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-01-23 wl StatusNone => Fixed
        PrivacyPrivate => Public
        Assigned toNone => wl
        Open/ClosedOpen => Closed
        Planned ReleaseNone => 2.5.3
    2014-01-22 j00ru Attached File- => Added msan_uninit-mem_7ffcbb6681bf_2488_Verdana.pfr, #30344
        Attached File- => Added msan_uninit-mem_7f13afca61bf_3006_bin01st.t42, #30345
        Attached File- => Added msan_uninit-mem_7ff02c9f50e7_1579_DejaVuSansMono.t42, #30346

    Back to the top


    Powered by Savane 3.3