bugThe FreeType Project - Bugs: bug #41309, Use of uninitialized memory in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #41309: Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Wed 22 Jan 2014 07:42:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.5.3

Thu 23 Jan 2014 07:15:58 AM UTC, comment #1: 

Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Wed 22 Jan 2014 07:42:09 PM UTC, original submission:  

There are three different use-of-uninitialized-memory conditions in psobjs.c, t42parse.c and t1load.c.
All of them have been reproduced with ftbench (with the -p command line option) compiled on Ubuntu amd64.

While only MSan log messages are shown below, the issues can also be reproduced with valgrind (confirmed), though with less informative warning messages.

MemorySanitizer logs:

==14397== WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f5e51ed20e7 in FT_RoundFix freetype2/src/base/ftcalc.c:78
    #1 0x7f5e527ddecc in ps_parser_load_field freetype2/src/psaux/psobjs.c:1213
    #2 0x7f5e5238b1d2 in t42_load_keyword freetype2/src/type42/t42parse.c:1014
    #3 0x7f5e5238820f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
    #4 0x7f5e5237ef9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
    #5 0x7f5e5236f576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
    #6 0x7f5e51f11d70 in open_face freetype2/src/base/ftobjs.c:1191
    #7 0x7f5e51f0b3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
    #8 0x7f5e51f0f6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
    #9 0x7f5e51eb21c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
    #10 0x7f5e51eade2f in main ft2demos-2.5.2/src/ftbench.c:918

  Uninitialized value was created by an allocation of 'temp' in the stack frame of function 'ps_parser_load_field'
    #0 0x7f5e527d9a30 in ps_parser_load_field freetype2/src/psaux/psobjs.c:1029

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:78 FT_RoundFix
---------------------------------------------------------------------------------------------------------------------
==14517== WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f93585fa1bf in FT_DivFix freetype2/src/base/ftcalc.c:560
    #1 0x7f9358aab481 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:276
    #2 0x7f9358aa956a in t42_load_keyword freetype2/src/type42/t42parse.c:981
    #3 0x7f9358aa720f in t42_parse_dict freetype2/src/type42/t42parse.c:1128
    #4 0x7f9358a9df9d in T42_Open_Face freetype2/src/type42/t42objs.c:57
    #5 0x7f9358a8e576 in T42_Face_Init freetype2/src/type42/t42objs.c:196
    #6 0x7f9358630d70 in open_face freetype2/src/base/ftobjs.c:1191
    #7 0x7f935862a3f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
    #8 0x7f935862e6ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
    #9 0x7f93585d11c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
    #10 0x7f93585cce2f in main ft2demos-2.5.2/src/ftbench.c:918

  Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't42_parse_font_matrix'
    #0 0x7f9358aaa2a0 in t42_parse_font_matrix freetype2/src/type42/t42parse.c:251

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix
---------------------------------------------------------------------------------------------------------------------
==14283== WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f7a67d141bf in FT_DivFix freetype2/src/base/ftcalc.c:560
    #1 0x7f7a67faca07 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1137
    #2 0x7f7a67fa9964 in t1_load_keyword freetype2/src/type1/t1load.c:932
    #3 0x7f7a67f9c829 in parse_dict freetype2/src/type1/t1load.c:1996
    #4 0x7f7a67f8a035 in T1_Open_Face freetype2/src/type1/t1load.c:2104
    #5 0x7f7a67f5efbe in T1_Face_Init freetype2/src/type1/t1objs.c:339
    #6 0x7f7a67d4ad70 in open_face freetype2/src/base/ftobjs.c:1191
    #7 0x7f7a67d443f4 in FT_Open_Face freetype2/src/base/ftobjs.c:2120
    #8 0x7f7a67d486ef in FT_New_Memory_Face freetype2/src/base/ftobjs.c:1281
    #9 0x7f7a67ceb1c8 in get_face ft2demos-2.5.2/src/ftbench.c:695
    #10 0x7f7a67ce6e2f in main ft2demos-2.5.2/src/ftbench.c:918

  Uninitialized value was created by an allocation of 'temp' in the stack frame of function 't1_parse_font_matrix'
    #0 0x7f7a67fab460 in t1_parse_font_matrix freetype2/src/type1/t1load.c:1098

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/base/ftcalc.c:560 FT_DivFix

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #30345:  msan_uninit-mem_7f13afca61bf_3006_bin01st.t42 added by j00ru (70KiB - application/octet-stream)
file #30344:  msan_uninit-mem_7ffcbb6681bf_2488_Verdana.pfr added by j00ru (84KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-01-23 wl StatusNone Fixed
        PrivacyPrivate Public
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.5.3
    2014-01-22 j00ru Attached File- Added msan_uninit-mem_7ffcbb6681bf_2488_Verdana.pfr, #30344
        Attached File- Added msan_uninit-mem_7f13afca61bf_3006_bin01st.t42, #30345
        Attached File- Added msan_uninit-mem_7ff02c9f50e7_1579_DejaVuSansMono.t42, #30346

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code