bugThe FreeType Project - Bugs: bug #41693, Out-of-bounds read in...

 
 

bug #41693: Out-of-bounds read in cff_fd_select_get

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Tue 25 Feb 2014 07:15:05 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 26 Feb 2014 01:20:58 PM UTC, comment #2:

Fixed in git. Thanks for the report.

BTW, the reason for not being able to attach your sample files is that they are too large. Somehow the advertised 16384kByte size limit for attachments is not correct; this is a bug in Savannah itself, as far as I know.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 25 Feb 2014 07:21:11 PM UTC, comment #1:

I'm not sure why I cannot attach sample files, they are available at:

http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_9202_sigsegv1.ttf
http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_9201_sigsegv1.ttf
http://j00ru.vexillium.org/dump/asan_heap-oob_6d3da2_123_12009.22432.otf

Mateusz Jurczyk <j00ru>
Project Member
Tue 25 Feb 2014 07:15:05 PM UTC, original submission:

Tested on Ubuntu AMD64 with upstream FreeType2 and FreeType2-demos using ./ftbench <file>:

=================================================================
==25103==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edb2 at pc 0x6a61ec bp 0x7fff1b272510 sp 0x7fff1b272508
READ of size 1 at 0x60200000edb2 thread T0
#0 0x6a61eb in cff_fd_select_get freetype2/src/cff/cffload.c:744
#1 0x69f94a in cff_slot_load freetype2/src/cff/cffgload.c:2762
#2 0x66b8b0 in cff_glyph_load freetype2/src/cff/cffdrivr.c:185
#3 0x4a28e2 in FT_Load_Glyph freetype2/src/base/ftobjs.c:726
#4 0x492475 in test_load freetype2-demos/src/ftbench.c:249
#5 0x4930e7 in benchmark freetype2-demos/src/ftbench.c:216
#6 0x48f692 in main freetype2-demos/src/ftbench.c:1020

0x60200000edb2 is located 0 bytes to the right of 2-byte region [0x60200000edb0,0x60200000edb2)
allocated by thread T0 here:
#0 0x474821 in __interceptor_malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
#1 0xa6611f in ft_alloc freetype2/src/base/ftsystem.c:74
#2 0x519409 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
#3 0x518121 in FT_Stream_EnterFrame freetype2/src/base/ftstream.c:267
#4 0x517a05 in FT_Stream_ExtractFrame freetype2/src/base/ftstream.c:200
#5 0x6839e6 in CFF_Load_FD_Select freetype2/src/cff/cffload.c:695
#6 0x6782a2 in cff_font_load freetype2/src/cff/cffload.c:1585
#7 0x6615ff in cff_face_init freetype2/src/cff/cffobjs.c:582
#8 0x4c95ce in open_face freetype2/src/base/ftobjs.c:1191
#9 0x4c57cd in FT_Open_Face freetype2/src/base/ftobjs.c:2123
#10 0x4c3ca4 in FT_New_Face freetype2/src/base/ftobjs.c:1254
#11 0x491d0f in get_face freetype2-demos/src/ftbench.c:705
#12 0x48e6c4 in main freetype2-demos/src/ftbench.c:924

SUMMARY: AddressSanitizer: heap-buffer-overflow freetype2/src/cff/cffload.c:744 cff_fd_select_get
Shadow bytes around the buggy address:
0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa 00 00 fa fa 00 01
=>0x0c047fff9db0: fa fa fd fa fa fa[02]fa fa fa fd fd fa fa fd fd
0x0c047fff9dc0: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa 00 06
0x0c047fff9dd0: fa fa 00 01 fa fa 00 00 fa fa fd fd fa fa fd fa
0x0c047fff9de0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 fa
0x0c047fff9df0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: =25103==ABORTING

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 26 Feb 2014 01:20:58 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.3

    Back to the top


    Powered by Savane 3.1-cleanup1