bugThe FreeType Project - Bugs: bug #41310, Use of uninitialized memory in...

 
 

bug #41310: Use of uninitialized memory in tt_sbit_decoder_load_bitmap

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Wed 22 Jan 2014 07:48:30 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 23 Jan 2014 08:15:05 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 22 Jan 2014 07:48:30 PM UTC, original submission:

There is a use-of-uninitialized-memory condition in the TTF parser in FreeType2, which has been reproduced using ftbench (with the -p command line option) built on Ubuntu amd64.

While only MSan log messages are shown below, the issues can also be reproduced with valgrind (confirmed), though with less informative warning messages.

MemorySanitizer log:

==15474== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fe75a8a3e22 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:992
#1 0x7fe75a89c272 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1220
#2 0x7fe75a87814b in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1384
#3 0x7fe75a45029a in load_sbit_image freetype2/src/truetype/ttgload.c:2021
#4 0x7fe75a44c5c6 in TT_Load_Glyph freetype2/src/truetype/ttgload.c:2348
#5 0x7fe75a378d2a in tt_glyph_load freetype2/src/truetype/ttdriver.c:404
#6 0x7fe75a25e5d1 in FT_Load_Glyph freetype2/src/base/ftobjs.c:726
#7 0x7fe75a241ea0 in test_load ft2demos-2.5.2/src/ftbench.c:246
#8 0x7fe75a2435a6 in benchmark ft2demos-2.5.2/src/ftbench.c:216
#9 0x7fe75a23e763 in main ft2demos-2.5.2/src/ftbench.c:1011

Uninitialized value was created by an allocation of 'metrics' in the stack frame of function 'load_sbit_image'
#0 0x7fe75a44f570 in load_sbit_image freetype2/src/truetype/ttgload.c:2009

SUMMARY: MemorySanitizer: use-of-uninitialized-value freetype2/src/sfnt/ttsbit.c:992 tt_sbit_decoder_load_bitmap

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 23 Jan 2014 08:15:05 AM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.3
    Wed 22 Jan 2014 07:48:30 PM UTCj00ruAttached File-=>Added msan_uninit-mem_7f88af180e22_8745_e459a17d2820cda2d26f4dfa58ac1b81.ttf, #30347

    Back to the top


    Powered by Savane 3.1-cleanup1