bugThe FreeType Project - Bugs: bug #45922, buffer overflow in skip_comment...

 
 

bug #45922: buffer overflow in skip_comment while doing FT_New_Memory_Face

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Fri 11 Sep 2015 06:18:30 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 12 Sep 2015 06:33:50 AM UTC, comment #1:

Fixed in git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 11 Sep 2015 06:18:30 AM UTC, original submission:

found on fresh git with libFuzzer+AddressSanitizer

#include <ft2build.h>
#include FT_FREETYPE_H
#include <assert.h>
#include <stdlib.h>
#include <string.h>
static FT_Library library;
void TestOneInput(const unsigned char *data, size_t size) {
FT_Face face;
if (size < 1) return;
if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
FT_Done_Face(face);
}
}
unsigned char a[] = {
0x25, 0x21, 0x46, 0x6f, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x31, 0x2d,
0x31, 0x2e, 0x30, 0x3a, 0x20, 0x2f, 0x54, 0x54, 0x41, 0x35, 0x41, 0x39,
0x6f, 0x30, 0x30, 0x2b, 0x5a, 0x45, 0x56, 0x48, 0x50, 0x65, 0x2d, 0x31,
0x20, 0x30, 0x30, 0x31, 0x2e, 0x30, 0x30, 0x33, 0xd, 0x31, 0x31, 0x22,
0x64, 0x69, 0x63, 0x74, 0x20, 0x62, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x6e,
0xd, 0x46, 0x2f, 0x74, 0x54, 0x79, 0x70, 0x31, 0x20, 0x65, 0x20, 0x2f,
0x65, 0x66, 0x64, 0xd, 0x46, 0x6f, 0x6e, 0x74, 0x4d, 0x61, 0x74, 0x72,
0x69, 0x78, 0x20, 0x5b, 0x30, 0x2e, 0x30, 0x31, 0x20, 0x30, 0x20, 0x30,
0x20, 0x30, 0x2e, 0x30, 0x30, 0x31, 0x20, 0x30, 0x20, 0x30, 0x5d, 0x20,
0x72, 0x65, 0x61, 0x64, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x64, 0x65, 0x66,
0xd, 0x2d, 0x46, 0x6f, 0x6e, 0x74, 0x4e, 0x61, 0xf2, 0x6d, 0x65, 0x20,
0x2f, 0x54, 0x41, 0x30, 0x41, 0x39, 0x6f, 0x30, 0x30, 0x2b, 0x5a, 0x45,
0x56, 0x48, 0x50, 0x45, 0x2d, 0x31, 0x20, 0x64, 0x65, 0x66, 0xd, 0x2f,
0x46, 0x6f, 0x6e, 0x74, 0x42, 0x42, 0x6f, 0x78, 0x25, 0x21, 0x50, 0x53,
0x2d, 0x41, 0x64, 0x65, 0x6f, 0x6f, 0x62, 0x46, 0x6e, 0x74, 0x2d, 0x31,
0x4f, 0x54, 0x54, 0x4f, 0x0, 0x9, 0x80, 0x0, 0x3, 0x0, 0x10, 0x43,
0x80, 0x1, 0x1b, 0xe, 0x0, 0x0, 0x25, 0x21, 0x50, 0x2d, 0x41, 0x64,
0x6f, 0x62, 0x65, 0x46, 0x6f, 0x6e, 0x74, 0x2d, 0x31, 0x2e, 0x31, 0x3a,
0x20, 0x43, 0x4d, 0x52, 0x31, 0x30, 0x20, 0x31, 0x2e, 0x30, 0x30, 0x42,
0xd, 0x3c, 0x25, 0x25, 0x43, 0x72, 0x65, 0x61, 0x74, 0x69, 0x6f, 0x6e,
0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x31, 0x39, 0x39, 0x32, 0x20, 0x46,
0x65, 0x62, 0x20, 0x39};
int main(int argc, char **argv) {
if (FT_Init_FreeType(&library)) {
printf("Could not initialize library.\n");
return 1;
}
TestOneInput(a, sizeof(a));
}

==7310==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000897da0 at pc 0x00000061bdb0 bp 0x7ffd08d2db50 sp 0x7ffd08d2db48
READ of size 1 at 0x000000897da0 thread T0
#0 0x61bdaf in skip_comment src/psaux/psobjs.c:293:12
#1 0x61bdaf in skip_spaces src/psaux/psobjs.c:315
#2 0x61bdaf in ps_parser_skip_spaces src/psaux/psobjs.c:605
#3 0x61bdaf in ps_parser_to_token src/psaux/psobjs.c:626
#4 0x61c449 in ps_parser_load_field src/psaux/psobjs.c:1059:7
#5 0x534d8f in t1_load_keyword src/type1/t1load.c:1016:17
#6 0x534d8f in parse_dict src/type1/t1load.c:2005
#7 0x528466 in T1_Open_Face src/type1/t1load.c:2113:13
#8 0x528466 in T1_Face_Init src/type1/t1objs.c:339
#9 0x4debc4 in open_face src/base/ftobjs.c:1166:15
#10 0x4dd6ff in FT_Open_Face src/base/ftobjs.c:2152:19
#11 0x4de85c in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#12 0x4d449a in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x4d449a)
#13 0x4d4586 in main (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x4d4586)
#14 0x7f424f36dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#15 0x41c145 in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x41c145)

0x000000897da0 is located 0 bytes to the right of global variable 'a' defined in './repro1.c:14:15' (0x897ca0) of size 256

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 12 Sep 2015 06:33:50 AM UTCwlItem GroupNone=>Crash
      StatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.1

    Back to the top


    Powered by Savane 3.1-cleanup1