bugThe FreeType Project - Bugs: bug #44354, Heap-buffer-overflow in...

 
 

bug #44354: Heap-buffer-overflow in ps_table_add

Submitted by:  Jun Fang <sanqingsong>
Submitted on:  Mon 23 Feb 2015 08:41:47 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: DuplicatePrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.4.7

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 07 Mar 2015 07:19:51 AM UTC, comment #3:

please change Privacy to private.

Jun Fang <sanqingsong>
Tue 24 Feb 2015 06:18:47 PM UTC, comment #2:

Thanks for your update. The version of freetype in chromium is 2.4.8.

Jun Fang <sanqingsong>
Tue 24 Feb 2015 05:10:32 AM UTC, comment #1:

Thanks for the report. However, you haven't mentioned the FreeType version you use.

What you propose in your patch was added to FreeType's git repository on 2012-Jul-18 (commit a8c24351) and published as version 2.4.11. It corresponds to Savannah bug #36829, so we have a duplicate.

Consequently, I'm closing the report. If you still get the problem with a current FreeType version, it must be a different issue. To analyze this further I ask you to extract the problematic font from the PDF with a tool like `pdffonts', then running a FreeType demo program like `ftbench' to get an ASAN report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 23 Feb 2015 08:41:47 PM UTC, original submission:

This issue was originally reported in https://code.google.com/p/chromium/issues/detail?id=455363&q=owner%3Ame&colspec=ID%20Pri%20M%20Week%20ReleaseBlock%20Cr%20Status%20Owner%20Summary%20OS%20Modified.

If you can't access the above link, you can follow the steps in http://code.google.com/p/pdfium/wiki/Build to build pdfium in linux and setup ASAN environment by following the steps in http://www.chromium.org/developers/testing/addresssanitizer.

after pdfium_test is built successfully, please run this command:
./pdfium_test /home/foxit/Downloads/fuzz-122.pdf 2>&1 | ../../tools/valgrind/asan/asan_symbolize.py

After I investigated this issue, I found that it's a freetype issue. The patch is attached (diff_t1load.c) for your reference.

Jun Fang <sanqingsong>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #33167:  diff_t1load.c added by sanqingsong (409B - text/plain)
file #33168:  fuzz-122.pdf added by sanqingsong (2MiB - application/pdf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by sanqingsong (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 24 Feb 2015 05:10:32 AM UTCwlStatusNone=>Duplicate
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.4.7
    Mon 23 Feb 2015 08:41:47 PM UTCsanqingsongAttached File-=>Added diff_t1load.c, #33167
      Attached File-=>Added fuzz-122.pdf, #33168

    Back to the top


    Powered by Savane 3.1-cleanup1