bugThe FreeType Project - Bugs: bug #45955, buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45955: buffer overflow in T1_Get_Private_Dict/strncmp

Submitter:  Kostya Serebryany <kcc>
Submitted:  Sun 13 Sep 2015 08:03:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.1

Sun 13 Sep 2015 10:41:12 PM UTC, comment #3: 

Thanks a lot, that helped.  It seems that I did something wrong...

Fix now in git.

Werner LEMBERG <wl>
Group administrator
Sun 13 Sep 2015 09:17:48 PM UTC, comment #2: 

I am pretty sure, just re-confirmed with the following .sh script and valgrind.

==34337== Invalid read of size 1
==34337==    at 0x422651: T1_Get_Private_Dict (t1parse.c:377)
==34337==    by 0x422651: T1_Open_Face (t1load.c:2118)
==34337==    by 0x422F40: T1_Face_Init (t1objs.c:339)
==34337==    by 0x40FA41: open_face (ftobjs.c:1166)
==34337==    by 0x4112F2: FT_Open_Face (ftobjs.c:2156)
==34337==    by 0x411908: FT_New_Memory_Face (ftobjs.c:1256)
==34337==    by 0x4089D6: TestOneInput (repro.c:10)
==34337==    by 0x408AF7: main (repro.c:28)
==34337==  Address 0x69c9360 is 0 bytes after a block of size 256 alloc'd
==34337==    at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==34337==    by 0x408ACB: main (repro.c:26)



#!/bin/bash

git clone git://git.sv.nongnu.org/freetype/freetype2.git
cd freetype2/
./autogen.sh
./configure
make -j
cat << EOF > repro.c
#include <ft2build.h>
#include FT_FREETYPE_H
#include <assert.h>
#include <stdlib.h>
#include <string.h>
static FT_Library  library;
void TestOneInput(const unsigned char *data, size_t size) {
  FT_Face face;
  if (size < 1) return;
  if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
    FT_Done_Face(face);
  }
}
unsigned char a[1 << 24];
int main(int argc, char **argv) {
  if (FT_Init_FreeType(&library)) {
    printf("Could not initialize library.\n");
    return 1;
  }
  assert(argc == 2);
  FILE *f = fopen(argv[1], "r");
  assert(f);
  size_t n = fread(a, 1, sizeof(a), f);
  assert(n > 0);
  fclose(f);
  unsigned char b = (unsigned char )malloc(n);
  memcpy(b, a, n);
  TestOneInput(b, n);
  free(b);
}
EOF


gcc -g repro.c -Iinclude ./objs/.libs/libfreetype.a -lbz2 -lz -lpng -lharfbuzz -o repro_vg

cat << EOF | base64 --decode > input
JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==
EOF

valgrind ./repro_vg input

Kostya Serebryany <kcc>
Group Member
Sun 13 Sep 2015 08:26:43 PM UTC, comment #1: 

Hmm.  Compiling the current git version of the library with gcc's `-fsanitize=address', I get the correct

    T1_Get_Private_Dict: premature end in private dictionary

if feeding the data into your `repro.c'...

The same for compiling with clang (and -fsanitize=adress).

Are you sure that you get this problem with current git?

Werner LEMBERG <wl>
Group administrator
Sun 13 Sep 2015 08:03:09 PM UTC, original submission:  

found on fresh git with libFuzzer+AddressSanitizer
This one looks similar to #45923, but reproduces both before and after its fix.

Feed the data below (base64-encoded) into FT_New_Memory_Face

==12952==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000a000 at pc 0x00000042747a bp 0x7ffe8d4b5cb0 sp 0x7ffe8d4b5468
READ of size 2 at 0x61100000a000 thread T0
    #0 0x427479 in __interceptor_strncmp
    #1 0x52a2f5 in T1_Get_Private_Dict src/type1/t1parse.c:377:29
    #2 0x52a2f5 in T1_Open_Face src/type1/t1load.c:2118
    #3 0x52a2f5 in T1_Face_Init src/type1/t1objs.c:339
    #4 0x4df044 in open_face src/base/ftobjs.c:1166:15
    #5 0x4ddb7f in FT_Open_Face src/base/ftobjs.c:2156:19
    #6 0x4decdc in FT_New_Memory_Face src/base/ftobjs.c:1256:12

0x61100000a000 is located 0 bytes to the right of 256-byte region [0x611000009f00,0x61100000a000)
allocated by thread T0 here:
    #0 0x4abe2b in malloc
    #1 0x4d4713 in main

JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  • -email is unavailable- added by kcc
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-09-13 wl StatusWorks For Me Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.1
    2015-09-13 wl StatusNone Works For Me
        Assigned toNone wl
    2015-09-13 kcc Carbon-Copy- Added j00ru

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code