bugThe FreeType Project - Bugs: bug #44461, Heap-use-after-free in...

 
 

bug #44461: Heap-use-after-free in FT_Stream_ReleaseFrame

Submitted by:  Jun Fang <sanqingsong>
Submitted on:  Sat 07 Mar 2015 05:44:56 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: InvalidPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 30 Jul 2015 03:49:02 AM UTC, comment #8:

Thanks, closing.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 29 Jul 2015 09:03:03 PM UTC, comment #7:

Fixed in Pdfium after all:
https://code.google.com/p/chromium/issues/detail?id=452793#c14
https://code.google.com/p/chromium/issues/detail?id=452793#c16

Alexei Podtelezhnikov <podtelez>
Project Member
Sat 06 Jun 2015 04:01:08 AM UTC, comment #6:

Any news? Are you able to provide a stand-alone example that exhibits the bug? Since Mateusz confirmed the issue, it would be really worth the time...

Alternatively (or additionally), you might try to build the library with the configuration options FT_DEBUG_LEVEL_ERROR and FT_DEBUG_LEVEL_TRACE (see file docs/DEBUG for more), then adding FT_TRACE[0-7] calls to the FreeType source code.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 30 Mar 2015 02:40:04 PM UTC, comment #5:

I confirm that I can reproduce this issue with latest FreeType and pdfium_test (from public git) compiled with AddressSanitizer. However, I am not very familiar with the pdfium codebase, therefore I don't know the root cause of the crash and I agree that it would be best if the reporter could prepare a stand-alone proof of concept code which shows the problem.

Mateusz Jurczyk <j00ru>
Project Member
Wed 25 Mar 2015 03:10:28 PM UTC, comment #4:

Any progress? I'm CCing Mateusz also for this bug report, just in case...

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 07 Mar 2015 09:13:39 AM UTC, comment #3:

I looked into the FreeType source related to the bug trace, and I haven't found something suspicious, sorry.

Unfortunately, pdfium is far too complex for me, making it very hard to quickly find out what's going on. Can you extract the code in `fx_ge_font.cpp' that uses FT_OPEN_STREAM and write a small stand-alone, compilable snippet that reproduces the bug?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 07 Mar 2015 07:18:51 AM UTC, comment #2:

Can you help to change Privacy to private? Thanks!

Jun Fang <sanqingsong>
Sat 07 Mar 2015 05:52:36 AM UTC, comment #1:

some corrections for the analysis:

stream refers to the stream allocated in Pdfium. After the stream is released by Pdfium, freetype tries to access it.

=================================================================
==21334==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000177fe8 at pc 0x00000214aa31 bp 0x7fff8a8eb000 sp 0x7fff8a8eaff8
READ of size 8 at 0x607000177fe8 thread T0
#0 0x214aa30 in FT_Stream_ReleaseFrame /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/base/ftstream.c:218:10
#1 0x2193746 in sfnt_done_face /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/sfnt/ttkern.c:172:5
#2 0x21a872c in tt_face_done /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/truetype/ttobjs.c:697:7
#3 0x2140958 in destroy_face /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/base/ftobjs.c:946:7
#4 0x21403e0 in FT_Done_Face /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/base/ftobjs.c:2430:11
#5 0x2146c5f in FT_Done_Library /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/base/ftobjs.c:4797:13
#6 0x214d297 in FT_Done_FreeType /ssd/mbarbella/beh/src/third_party/pdfium/third_party/freetype/src/base/ftinit.c:277:5
#7 0xaa0352 in CFX_FontMgr::~CFX_FontMgr() /ssd/mbarbella/beh/src/third_party/pdfium/core/src/fxge/ge/fx_ge_fontmap.cpp:80:9
#8 0xa9681b in CFX_GEModule::Destroy() /ssd/mbarbella/beh/src/third_party/pdfium/core/src/fxge/ge/fx_ge.cpp:25:9
#9 0x4a8342 in FPDF_DestroyLibrary /ssd/mbarbella/beh/src/third_party/pdfium/fpdfsdk/src/fpdfview.cpp:242:2
#10 0x4a55f0 in main /ssd/mbarbella/beh/src/third_party/pdfium/samples/pdfium_test.cc:533:3
#11 0x7f1bae011ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
0x607000177fe8 is located 40 bytes inside of 80-byte region [0x607000177fc0,0x607000178010)
freed by thread T0 here:
#0 0x484fe9 in __interceptor_free
#1 0xa9ca70 in CFX_Font::~CFX_Font() /ssd/mbarbella/beh/src/third_party/pdfium/core/src/fxge/ge/fx_ge_font.cpp:83:9
#2 0x1e6d8bb in CFX_GEFont::~CFX_GEFont() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fgas/src/font/fx_gefont.cpp:167:9
#3 0x1e6d9bd in CFX_GEFont::~CFX_GEFont() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fgas/src/font/fx_gefont.cpp:140:1
#4 0x1cfc998 in CXFA_FWLTheme::~CXFA_FWLTheme() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fxfa/src/app/xfa_fwltheme.cpp:88:9
#5 0x1cfce5d in CXFA_FWLTheme::~CXFA_FWLTheme() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fxfa/src/app/xfa_fwltheme.cpp:46:1
#6 0x1d006d1 in CXFA_FWLTheme::Release() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fxfa/src/app/xfa_fwltheme.h:16:9
#7 0x1cb0411 in CXFA_FFApp::~CXFA_FFApp() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fxfa/src/app/xfa_ffapp.cpp:169:9
#8 0x1cb1065 in CXFA_FFApp::Release() /ssd/mbarbella/beh/src/third_party/pdfium/xfa/src/fxfa/src/app/xfa_ffapp.h:53:9
#9 0x1ca00c8 in CPDFXFA_App::~CPDFXFA_App() /ssd/mbarbella/beh/src/third_party/pdfium/fpdfsdk/src/fpdfxfa/fpdfxfa_app.cpp:70:3
#10 0x1c9fe79 in FPDFXFA_ReleaseApp() /ssd/mbarbella/beh/src/third_party/pdfium/fpdfsdk/src/fpdfxfa/fpdfxfa_app.cpp:28:3
#11 0x4a8338 in FPDF_DestroyLibrary /ssd/mbarbella/beh/src/third_party/pdfium/fpdfsdk/src/fpdfview.cpp:233:2
#12 0x4a55f0 in main /ssd/mbarbella/beh/src/third_party/pdfium/samples/pdfium_test.cc:533:3
#13 0x7f1bae011ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287

Jun Fang <sanqingsong>
Sat 07 Mar 2015 05:44:56 AM UTC, original submission:

The original bug was reported in https://code.google.com/p/chromium/issues/detail?id=452793&

I investigated this issue from Pdfium's perspective, an open pdf project from Google and found the suspected code is as below:

stream is referred to the the stream which is allocated in Pdfium. When the stream is released by Pdfium, freetype tries to release it again.

in ftobjs.c
FT_Stream_New( FT_Library library,
const FT_Open_Args* args,
FT_Stream *astream )

/* in this case, we do not need to allocate a new stream object */
/* since the caller is responsible for closing it himself */
FT_FREE( stream );
stream = args->stream;

Jun Fang <sanqingsong>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #33275:  revisiontest.pdf added by sanqingsong (18KiB - application/pdf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by podtelez (Posted a comment)
  • -unavailable- added by j00ru (Posted a comment)
  • -unavailable- added by wl
  • -unavailable- added by wl (Updated the item)
  • -unavailable- added by sanqingsong (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 30 Jul 2015 03:49:02 AM UTCwlStatusNeed Info=>Invalid
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
    Wed 25 Mar 2015 03:10:28 PM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
      Carbon-Copy-=>Added j00ru
    Sat 07 Mar 2015 07:22:55 AM UTCwlPrivacyPublic=>Private
    Sat 07 Mar 2015 05:44:56 AM UTCsanqingsongAttached File-=>Added revisiontest.pdf, #33275

    Back to the top


    Powered by Savane 3.1-cleanup1