bugThe FreeType Project - Bugs: bug #46028, leak in Mac_Read_sfnt_Resource

 
 

bug #46028: leak in Mac_Read_sfnt_Resource

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Tue 22 Sep 2015 04:18:11 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: suzuki toshiya <mpsuzuki>Open/Closed: Closed
Planned Release: 2.6.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 27 Sep 2015 09:09:21 PM UTC, comment #3:

Thanks!

Werner LEMBERG <wl>
Project Administrator
Sun 27 Sep 2015 05:08:28 PM UTC, comment #2:

Sorry for lated action, just I've fixed on git head
Also the patch is attached.

Considering with the fix for #45919, it seems that
the declared resource (or fragment of resource)
length should be compared with the length of
the rest data in the stream.

(file #34997)

suzuki toshiya <mpsuzuki>
Project AdministratorIn charge of this item.
Fri 25 Sep 2015 03:49:57 AM UTC, comment #1:

Toshiya-san, please fix. It should be straightforward to free the `sfnt_data' array in case of error.

BTW, I think a similar bug exists also for the `sfnt_ps' array in function `open_face_PS_from_sfnt_stream': If `length' is too large, the call to FT_Stream_Read returns an error, and the array is not freed correctly.

Werner LEMBERG <wl>
Project Administrator
Tue 22 Sep 2015 04:18:11 PM UTC, original submission:

found on fresh git with libFuzzer+ASan (on x86_64 Linux)
Feed the attached file to FT_New_Memory_Face

==21585==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5687296 byte(s) in 1 object(s) allocated from:
#0 0x4abe6b in malloc
#1 0x4fb512 in ft_mem_qalloc src/base/ftutil.c:76:15
#2 0x4fb512 in ft_mem_alloc src/base/ftutil.c:55
#3 0x4fb512 in Mac_Read_sfnt_Resource src/base/ftobjs.c:1794
#4 0x4fb512 in IsMacResource src/base/ftobjs.c:1864
#5 0x4de12c in load_mac_face src/base/ftobjs.c:2050:15
#6 0x4de12c in FT_Open_Face src/base/ftobjs.c:2202
#7 0x4df22c in FT_New_Memory_Face src/base/ftobjs.c:1256:12

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #34997:  mps20150927.diff added by mpsuzuki (2KiB - text/x-patch)
file #34953:  44f7e2bbf6a453b95358a4642761ef9690016ea5 added by kcc (27KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mpsuzuki (Updated the item)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Sep 2015 05:08:28 PM UTCmpsuzukiAttached File-=>Added mps20150927.diff, #34997
      StatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.1
    Fri 25 Sep 2015 03:49:57 AM UTCwlStatusNone=>Confirmed
      Assigned toNone=>mpsuzuki
    Tue 22 Sep 2015 04:18:11 PM UTCkccAttached File-=>Added 44f7e2bbf6a453b95358a4642761ef9690016ea5, #34953

    Back to the top


    Powered by Savane 3.1-cleanup1