The FreeType Project - Bugs: bug #41697, Out-of-bounds stack-based...
You are not allowed to post comments on this tracker with your current authentication level.
bug #41697: Out-of-bounds stack-based read/write in cf2_hintmap_build
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Tue 25 Feb 2014 08:43:38 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | darnold | Open/Closed: | Closed |
Planned Release: | 2.5.3 |
Jump to the original submission
Mon 10 Mar 2014 09:20:40 AM UTC, comment #8: |
Mateusz Jurczyk <j00ru>![]() |
Sat 01 Mar 2014 02:24:56 AM UTC, comment #7: Thanks for the quick turn-around!
|
Mateusz Jurczyk <j00ru>![]() |
Fri 28 Feb 2014 08:30:39 AM UTC, comment #6: Thanks a lot for the patches! They are now in the git repository. Right now I'm preparing a new release, to be available in one or two days, I guess.
|
Werner LEMBERG <wl>![]() |
Fri 28 Feb 2014 02:00:53 AM UTC, comment #5: The problem is triggered by a charstring with too many stem hints.
|
Dave Arnold <darnold>![]() ![]() |
Wed 26 Feb 2014 05:33:18 PM UTC, comment #4: Thanks, it now crashes properly :-) |
Werner LEMBERG <wl>![]() |
Wed 26 Feb 2014 05:06:52 PM UTC, comment #3: Yes, I am pretty sure that's the right font. It's strange you have difficulty reproducing it, as the bitCount variable is clearly larger than the maximum legal value of 96 in the source code I referred to.
|
Mateusz Jurczyk <j00ru>![]() |
Wed 26 Feb 2014 07:31:09 AM UTC, comment #2: Thanks for the report. Are you sure this is the right font? Dave Arnold can't reproduce it (and me neither, but I don't have a 64bit system – however, I get an assertion at a different place, something that should be fixed also).
|
Werner LEMBERG <wl>![]() |
Tue 25 Feb 2014 08:46:32 PM UTC, comment #1: Sample again did not get attached, available here: http://j00ru.vexillium.org/dump/asan_stack-oob_704686_9216_cov_3502053733_sigsegv2.ttf. |
Mateusz Jurczyk <j00ru>![]() |
Tue 25 Feb 2014 08:43:38 PM UTC, original submission:
Tested on Ubuntu AMD64 with upstream FreeType2 and FreeType2-demos, reproduced with ./ftbench <file>.
|
Mateusz Jurczyk <j00ru>![]() |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-03-07 | wl | Privacy | Private | ![]() |
Public |
2014-02-28 | wl | Status | Confirmed | ![]() |
Fixed |
Assigned to | wl | ![]() |
darnold | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.5.3 | ||
2014-02-26 | wl | Status | Need Info | ![]() |
Confirmed |
2014-02-26 | wl | Status | None | ![]() |
Need Info |
2014-02-25 | wl | Assigned to | None | ![]() |
wl |
Carbon-Copy | - | ![]() |
Added darnold |
Update: you can use CVE-2014-2240 as the identifier of the vulnerability.
You can also use CVE-2014-2241 for the other fix you submitted in relation to this bug, if required (not necessary).
Thanks,
Mateusz