bugThe FreeType Project - Bugs: bug #45955, buffer overflow in...

 
 

bug #45955: buffer overflow in T1_Get_Private_Dict/strncmp

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Sun 13 Sep 2015 08:03:09 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 13 Sep 2015 10:41:12 PM UTC, comment #3:

Thanks a lot, that helped. It seems that I did something wrong...

Fix now in git.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 13 Sep 2015 09:17:48 PM UTC, comment #2:

I am pretty sure, just re-confirmed with the following .sh script and valgrind.

==34337== Invalid read of size 1
==34337== at 0x422651: T1_Get_Private_Dict (t1parse.c:377)
==34337== by 0x422651: T1_Open_Face (t1load.c:2118)
==34337== by 0x422F40: T1_Face_Init (t1objs.c:339)
==34337== by 0x40FA41: open_face (ftobjs.c:1166)
==34337== by 0x4112F2: FT_Open_Face (ftobjs.c:2156)
==34337== by 0x411908: FT_New_Memory_Face (ftobjs.c:1256)
==34337== by 0x4089D6: TestOneInput (repro.c:10)
==34337== by 0x408AF7: main (repro.c:28)
==34337== Address 0x69c9360 is 0 bytes after a block of size 256 alloc'd
==34337== at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==34337== by 0x408ACB: main (repro.c:26)

#!/bin/bash

git clone git://git.sv.nongnu.org/freetype/freetype2.git
cd freetype2/
./autogen.sh
./configure
make -j
cat << EOF > repro.c
#include <ft2build.h>
#include FT_FREETYPE_H
#include <assert.h>
#include <stdlib.h>
#include <string.h>
static FT_Library library;
void TestOneInput(const unsigned char *data, size_t size) {
FT_Face face;
if (size < 1) return;
if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
FT_Done_Face(face);
}
}
unsigned char a[1 << 24];
int main(int argc, char **argv) {
if (FT_Init_FreeType(&library)) {
printf("Could not initialize library.\n");
return 1;
}
assert(argc == 2);
FILE *f = fopen(argv[1], "r");
assert(f);
size_t n = fread(a, 1, sizeof(a), f);
assert(n > 0);
fclose(f);
unsigned char b = (unsigned char )malloc(n);
memcpy(b, a, n);
TestOneInput(b, n);
free(b);
}
EOF

gcc -g repro.c -Iinclude ./objs/.libs/libfreetype.a -lbz2 -lz -lpng -lharfbuzz -o repro_vg

cat << EOF | base64 --decode > input
JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==
EOF

valgrind ./repro_vg input

Kostya Serebryany <kcc>
Project Member
Sun 13 Sep 2015 08:26:43 PM UTC, comment #1:

Hmm. Compiling the current git version of the library with gcc's `-fsanitize=address', I get the correct

T1_Get_Private_Dict: premature end in private dictionary

if feeding the data into your `repro.c'...

The same for compiling with clang (and -fsanitize=adress).

Are you sure that you get this problem with current git?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 13 Sep 2015 08:03:09 PM UTC, original submission:

found on fresh git with libFuzzer+AddressSanitizer
This one looks similar to #45923, but reproduces both before and after its fix.

Feed the data below (base64-encoded) into FT_New_Memory_Face

==12952==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000a000 at pc 0x00000042747a bp 0x7ffe8d4b5cb0 sp 0x7ffe8d4b5468
READ of size 2 at 0x61100000a000 thread T0
#0 0x427479 in __interceptor_strncmp
#1 0x52a2f5 in T1_Get_Private_Dict src/type1/t1parse.c:377:29
#2 0x52a2f5 in T1_Open_Face src/type1/t1load.c:2118
#3 0x52a2f5 in T1_Face_Init src/type1/t1objs.c:339
#4 0x4df044 in open_face src/base/ftobjs.c:1166:15
#5 0x4ddb7f in FT_Open_Face src/base/ftobjs.c:2156:19
#6 0x4decdc in FT_New_Memory_Face src/base/ftobjs.c:1256:12

0x61100000a000 is located 0 bytes to the right of 256-byte region [0x611000009f00,0x61100000a000)
allocated by thread T0 here:
#0 0x4abe2b in malloc
#1 0x4d4713 in main

JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  • -unavailable- added by kcc
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 13 Sep 2015 10:41:12 PM UTCwlStatusWorks For Me=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.1
    Sun 13 Sep 2015 08:26:43 PM UTCwlStatusNone=>Works For Me
      Assigned toNone=>wl
    Sun 13 Sep 2015 08:03:09 PM UTCkccCarbon-Copy-=>Added j00ru

    Back to the top


    Powered by Savane 3.1-cleanup1