bugThe FreeType Project - Bugs: bug #43591, FreeType 2.5.3 sbits parsing...

 
 

bug #43591: FreeType 2.5.3 sbits parsing potential out-of-bounds read due to integer overflow

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Wed 12 Nov 2014 06:59:14 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 13 Nov 2014 08:16:58 AM UTC, comment #1:

The fix LGTM, thanks!

Mateusz Jurczyk <j00ru>
Project Member
Wed 12 Nov 2014 06:59:14 PM UTC, original submission:

In freetype/src/sfnt/ttsbit.c, the following code responsible for parsing embedded bitmaps (so-called "sbits") is found:

323: FT_ULong strike_index_array;
324: FT_ULong strike_index_count;
...
377: decoder->strike_index_array = FT_NEXT_ULONG( p );
378: p += 4;
379: decoder->strike_index_count = FT_NEXT_ULONG( p );
380: p += 34;
381: decoder->bit_depth = *p;
382:
383: if ( decoder->strike_index_array > face->sbit_table_size ||
384: decoder->strike_index_array + 8 * decoder->strike_index_count >
385: face->sbit_table_size )
386: error = FT_THROW( Invalid_File_Format );

Note that the "strike_index_count" field is a fully controlled 32-bit variable, so if it is set to >= 0x20000000 in the input file, the "8 * decoder->strike_index_count" expression overflows on 32-bit builds of FreeType. Furthermore, the overall "decoder->strike_index_array + 8 * decoder->strike_index_count" expression can also overflow for smaller values of "strike_index_count", depending on "strike_index_array".

This can be used to bypass the sanity check and later trigger an out-of-bounds read in the "tt_sbit_decoder_load_image" function:

1059: FT_Byte* p = decoder->eblc_base + decoder->strike_index_array;
1060: FT_Byte* p_limit = decoder->eblc_limit;
1061: FT_ULong num_ranges = decoder->strike_index_count;
...
1066: for ( ; num_ranges > 0; num_ranges-- )
1067: {
1068: start = FT_NEXT_USHORT( p );
1069: end = FT_NEXT_USHORT( p );
1070:
1071: if ( glyph_index >= start && glyph_index <= end )
1072: goto FoundRange;
1073:
1074: p += 4; /* ignore index offset */
1075: }

Specifically, the "start" and "end" variables can be loaded from outside of the allocated buffer, if no corresponding glyph range is found inside of it. This can be used to crash the program using FreeType, or potentially disclose information about the contents of adjacent heap memory chunks.

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Updated the item)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 12 Nov 2014 10:36:41 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.4

    Back to the top


    Powered by Savane 3.1-cleanup1