bugThe FreeType Project - Bugs: bug #45661, invalid shift and memory access...

 
 

bug #45661: invalid shift and memory access within misaligned address

Submitted by:  Dingbao Xie <xiedingbao>
Submitted on:  Thu 30 Jul 2015 08:56:31 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 11 Feb 2016 06:47:32 AM UTC, comment #5:

I no longer get any clang errors with current git (now testing on 64bit) thus I'm closing this bug report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 04 Aug 2015 03:15:21 PM UTC, comment #4:

I do not know where I get wrong ideas.

Alexei Podtelezhnikov <podtelez>
Project Member
Tue 04 Aug 2015 04:14:19 AM UTC, comment #3:

> The signed left shifts are defined when the result fits
> and undefined when it does not.


This is not correct. From http://c0x.coding-guidelines.com/6.5.7.html:

1192 If E1 has a signed type and nonnegative value, and E1 × 2^E2 is representable in the result type, then that is the resulting value;

1193 otherwise, the behavior is undefined.

In other words, left-shifting a negative value is always undefined.

I think that checking for overflow before the multiplication is overkill. If you find an important place where you think such a check is necessary, please report it to the list.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 03 Aug 2015 05:53:18 PM UTC, comment #2:

Replacing left-shifts with multiplications only removes the waring. The signed left shifts are defined when the result fits and undefined when it does not. The replacement with multiplication can still overflow in an undefined manner. So the real fix should involve checking the range of values to be shifted or multiplied.

Alexei Podtelezhnikov <podtelez>
Project Member
Sat 01 Aug 2015 07:24:16 AM UTC, comment #1:

Thanks for the report. I'v fixed some left-shift issues in the git repository. However, I don't have a 64bit machine so I don't see the alignment problem, unfortunately.

Any chance that you can have a closer look, probably providing a fix?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 30 Jul 2015 08:56:31 PM UTC, original submission:

I found several undefined behavior in freetype-2.6 with afl-fuzzer.
To reproduce them, you need to build the source code with flag '-fsanitize=undefined'. Then compile the example code using cmd
clang -fsanitize=undefined example1.c -I ../local/include/freetype2/ ../local/lib/libfreetype.a -lz -lpng -lharfbuzz'.
After that execute cmd './example1 $font_file text/test', you will see the following error information:
freetype-2.6/src/base/ftobjs.c:2896:27: runtime error: member access within misaligned address 0x732f6e6f6d6d6f63 for type 'struct FT_DriverRec_', which requires 8 byte alignment
freetype-2.6/src/base/ftobjs.c:2896:19: runtime error: member access within misaligned address 0x000000e3b8ad for type 'struct FT_FaceRec_', which requires 8 byte alignment
freetype-2.6/src/truetype/ttgload.c:671:43: runtime error: left shift of negative value -16384
/freetype-2.6/src/truetype/ttgload.c:659:43: runtime error: left shift of negative value -16384

Dingbao Xie <xiedingbao>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #34558:  example1.c added by xiedingbao (4KiB - text/x-csrc)
file #34559:  malformed_font.zip added by xiedingbao (1MiB - application/zip)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by podtelez (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by xiedingbao (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Feb 2016 06:47:32 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Sat 01 Aug 2015 07:24:16 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Thu 30 Jul 2015 08:56:31 PM UTCxiedingbaoAttached File-=>Added example1.c, #34558
      Attached File-=>Added malformed_font.zip, #34559

    Back to the top


    Powered by Savane 3.1-cleanup1