bugThe FreeType Project - Bugs: bug #43776, FreeType 2.5.3 Type42 parsing...

 
 

bug #43776: FreeType 2.5.3 Type42 parsing invalid free in "t42_parse_sfnts"

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Mon 08 Dec 2014 09:21:39 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.5

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 11 Dec 2014 05:50:59 PM UTC, comment #4:

Thanks. This was fixed a few hours ago with patches related to Savannah bug #43794.

812ed34 * src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.
c9ca6ff * src/base/ftobjs.c (FT_Get_Glyph_Name): Fix off-by-one check.
b943811 * src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 10 Dec 2014 10:08:29 AM UTC, comment #3:

Sure, find the fonts with more sane names reattached.

(file #32635, file #32636, file #32637)

Mateusz Jurczyk <j00ru>
Project Member
Tue 09 Dec 2014 06:00:18 AM UTC, comment #2:

Mateusz, the funny file names of your attached fonts confuse Savannah, making it impossible to download them.

Please upload again with simplified names.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 08 Dec 2014 09:26:02 AM UTC, comment #1:

Oops, I see FreeType 2.5.4 has been released in the meanwhile. This report of course concerns the latest version (as per using current git head).

Mateusz Jurczyk <j00ru>
Project Member
Mon 08 Dec 2014 09:21:39 AM UTC, original submission:

The following invalid free() condition has been encountered in FreeType while fuzzing Type42 fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are three POC files which trigger the condition.

=================================================================
==1462==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x61b00001f70c in thread T0
#0 0x472581 in __interceptor_free (ft2demos-2.5.3/bin/ftbench+0x472581)
#1 0xafc208 in ft_free freetype2/src/base/ftsystem.c:130
#2 0x4b0f50 in ft_mem_free freetype2/src/base/ftutil.c:172
#3 0x536f3f in ft_mem_qrealloc freetype2/src/base/ftutil.c:135
#4 0x4b1de1 in ft_mem_realloc freetype2/src/base/ftutil.c:102
#5 0x7dc516 in t42_parse_sfnts freetype2/src/type42/t42parse.c:583
#6 0x7cfe70 in t42_load_keyword freetype2/src/type42/t42parse.c:1012
#7 0x7ce6b1 in t42_parse_dict freetype2/src/type42/t42parse.c:1159
#8 0x7c8b42 in T42_Open_Face freetype2/src/type42/t42objs.c:63
#9 0x7be5ab in T42_Face_Init freetype2/src/type42/t42objs.c:202
#10 0x4ccc8e in open_face freetype2/src/base/ftobjs.c:1170
#11 0x4c849b in FT_Open_Face freetype2/src/base/ftobjs.c:2151
#12 0x4c66a8 in FT_New_Face freetype2/src/base/ftobjs.c:1233
#13 0x491c53 in get_face ft2demos-2.5.3/src/ftbench.c:705
#14 0x48de68 in main ft2demos-2.5.3/src/ftbench.c:924

0x61b00001f70c is located 1420 bytes inside of 1456-byte region [0x61b00001f180,0x61b00001f730)
allocated by thread T0 here:
#0 0x4727a1 in malloc (ft2demos-2.5.3/bin/ftbench+0x4727a1)
#1 0xafbcef in ft_alloc freetype2/src/base/ftsystem.c:74
#2 0x528311 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
#3 0x4af8bf in ft_mem_alloc freetype2/src/base/ftutil.c:55
#4 0x7cbc91 in t42_parser_init freetype2/src/type42/t42parse.c:206
#5 0x7c897a in T42_Open_Face freetype2/src/type42/t42objs.c:56
#6 0x7be5ab in T42_Face_Init freetype2/src/type42/t42objs.c:202
#7 0x4ccc8e in open_face freetype2/src/base/ftobjs.c:1170
#8 0x4c849b in FT_Open_Face freetype2/src/base/ftobjs.c:2151
#9 0x4c66a8 in FT_New_Face freetype2/src/base/ftobjs.c:1233
#10 0x491c53 in get_face ft2demos-2.5.3/src/ftbench.c:705
#11 0x48de68 in main ft2demos-2.5.3/src/ftbench.c:924

SUMMARY: AddressSanitizer: bad-free ??:0 __interceptor_free
==1462==ABORTING

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #32635:  1.t42 added by j00ru (2KiB - application/octet-stream)
file #32636:  3.t42 added by j00ru (1KiB - application/octet-stream)
file #32637:  2.t42 added by j00ru (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 12 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Dec 2014 05:50:59 PM UTCwlStatusNeed Info=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.5
    Wed 10 Dec 2014 10:08:29 AM UTCj00ruAttached File-=>Added 1.t42, #32635
      Attached File-=>Added 3.t42, #32636
      Attached File-=>Added 2.t42, #32637
    Tue 09 Dec 2014 06:00:40 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Mon 08 Dec 2014 09:21:40 AM UTCj00ruAttached File-=>Added id%3A000000,sig%3A06,src%3A011260,op%3Ahavoc,rep%3A16, #32619
      Attached File-=>Added id%3A000001,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A64, #32620
      Attached File-=>Added id%3A000000,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A8, #32621

    Back to the top


    Powered by Savane 3.1-cleanup1