The FreeType Project - Bugs: bug #43794, Segfaults in Type 42 and CFF driver
You are not allowed to post comments on this tracker with your current authentication level.
bug #43794: Segfaults in Type 42 and CFF driver
Submitter: | None | ||
Submitted: | Wed 10 Dec 2014 04:20:52 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.5 |
Thu 11 Dec 2014 01:09:55 PM UTC, comment #1: |
Werner LEMBERG <wl> |
Wed 10 Dec 2014 04:20:52 PM UTC, original submission:
Using AFL ( http://lcamtuf.coredump.cx/afl/ ) I have discovered a segfault when using a defective Type 42 font in FreeType as well as a null pointer dereference in the CFF driver. I'm not sure if this has any security implications. The file as well as the accompanying GDB output are attached. |
Anonymous |
Attached Files
file #32639: id:000000,sig:11,src:000000,op:havoc,rep:16 added by None (2KiB - application/octet-stream)
file #32640: id:000000,sig:11,src:000000,op:havoc,rep:16.gdb added by None (3KiB - application/octet-stream)
file #32641: id:000001,sig:11,src:000000,op:havoc,rep:4 added by None (3KiB - application/octet-stream)
file #32642: id:000001,sig:11,src:000000,op:havoc,rep:4.gdb added by None (887B - application/octet-stream)
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-12-11 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.5 | |||
2014-12-10 | None | Attached File | - | Added id:000000,sig:11,src:000000,op:havoc,rep:16, #32639 | |
Attached File | - | Added id:000000,sig:11,src:000000,op:havoc,rep:16.gdb, #32640 | |||
Attached File | - | Added id:000001,sig:11,src:000000,op:havoc,rep:4, #32641 | |||
Attached File | - | Added id:000001,sig:11,src:000000,op:havoc,rep:4.gdb, #32642 |
Powered by Savane 3.13-caa5.
Corresponding source code
Already fixed in git, thanks.