bugThe FreeType Project - Bugs: bug #46109, use of uninitialized memory in...

 
 

bug #46109: use of uninitialized memory in pcf_read_TOC

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Sat 03 Oct 2015 08:03:55 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sun 04 Oct 2015 08:50:03 PM UTC, comment #9:

OK.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 04 Oct 2015 08:33:07 PM UTC, comment #8:

Let's treat this bug as done then.
Eventually we'll set up a proper msan build with all libs instrumented to avoid false positives.

So far, I don't have any other msan reports on my corpus and target function.

Kostya Serebryany <kcc>
Project Member
Sun 04 Oct 2015 08:14:21 PM UTC, comment #7:

Thanks for the file.

Indeed, it looks like a false positive for FreeType (since it is exactly the same spot already fixed), and yes, the code path uses functions from -lz (called via the `ftgzip.c' file).

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 04 Oct 2015 06:58:11 PM UTC, comment #6:

This one does not trigger with valgrind (the previous two did).
Sometimes msan may have false positives if it does not compile everything, and here we link 4 un-instrumented libs
(-lbz2 -lz -lpng -lharfbuzz).
Does this code path call any code from these libs?

Anyway, the repro attached.

(file #35063)

Kostya Serebryany <kcc>
Project Member
Sun 04 Oct 2015 11:19:28 AM UTC, comment #5:

Hmm, I can't repeat that with valgrind and the current git... Can you?

Please directly attach the offending file to this bug report; base64 reports an error message.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 04 Oct 2015 06:11:08 AM UTC, comment #4:

Interesting. The majority of msan reports are gone now,
but I still see at least one very similar to the original report:

==12403==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fa07dec4db5 in pcf_read_TOC src/pcf/pcfread.c:105:59
#1 0x7fa07dec4db5 in pcf_load_font src/pcf/pcfread.c:1183
#2 0x7fa07deb687c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#3 0x7fa07dc1da4d in open_face src/base/ftobjs.c:1166:15
#4 0x7fa07dc16b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#5 0x7fa07dc1ca0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
...

Uninitialized value was created by a heap allocation
#0 0x7fa07db8a392 in malloc
#1 0x7fa07e15c963 in ft_alloc builds/unix/ftsystem.c:102:12
#2 0x7fa07dc82e8c in ft_mem_qalloc src/base/ftutil.c:76:15
#3 0x7fa07e0cdb1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:638:11
#4 0x7fa07deb5da0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
#5 0x7fa07dc1da4d in open_face src/base/ftobjs.c:1166:15
#6 0x7fa07dc16b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#7 0x7fa07dc1ca0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12

H4sICmABvygnAAEAAADLRwEBCgH/CAEovwongAlhACkS6QEBAQH/CAEovwABAAAACwCAAAMAME9T
LwonAf8KAAIAAQABMj32TUQAAAEATmEAbWMAOHBp3QQ7AAAFZAAAA85nYXNw//8AAwAAPcAAAAAI
Z2x5Zp83nncAAAskAAAs/mhlYWTM6j51AAAAvAAAADZoaGVhDg0GF/8IASi/CicACQFNKCkBAAAB
/wgBKL8KJ9oAAAIBAQAKNx4nAAAA9AAAAQA=

Kostya Serebryany <kcc>
Project Member
Sun 04 Oct 2015 05:39:59 AM UTC, comment #3:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sun 04 Oct 2015 04:56:06 AM UTC, comment #2:

Cool!
This one is fixed, now I observe a similar one (a few lines later in pcf_read_TOC) on a another reproducer

==12852==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f44125dde01 in pcf_read_TOC src/pcf/pcfread.c:138:14
#1 0x7f44125dde01 in pcf_load_font src/pcf/pcfread.c:1183
#2 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#3 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
#4 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
#5 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#6 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
#7 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
#8 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#9 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)

Uninitialized value was stored to memory at
#0 0x7f44123a0d20 in FT_Stream_ReadFields src/base/ftstream.c:843:23
#1 0x7f44125d7a53 in pcf_read_TOC src/pcf/pcfread.c:116:12
#2 0x7f44125d7a53 in pcf_load_font src/pcf/pcfread.c:1183
#3 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#4 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
#5 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
#6 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#7 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
#8 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
#9 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#10 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)

Uninitialized value was stored to memory at
#0 0x7f441229c187 in __msan_memcpy
#1 0x7f44127eac27 in ft_gzip_file_io src/gzip/ftgzip.c:517:7
#2 0x7f441239acf0 in FT_Stream_EnterFrame src/base/ftstream.c:273:20
#3 0x7f44123a12e7 in FT_Stream_ReadFields src/base/ftstream.c:742:17
#4 0x7f44125d7a53 in pcf_read_TOC src/pcf/pcfread.c:116:12
#5 0x7f44125d7a53 in pcf_load_font src/pcf/pcfread.c:1183
#6 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#7 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
#8 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
#9 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#10 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
#11 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
#12 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#13 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)

Uninitialized value was created by a heap allocation
#0 0x7f44122a3392 in malloc
#1 0x7f44128758b3 in ft_alloc builds/unix/ftsystem.c:102:12
#2 0x7f441239be8c in ft_mem_qalloc src/base/ftutil.c:76:15
#3 0x7f44127e6b1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:632:11
#4 0x7f44125ceda0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
#5 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
#6 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
#7 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#8 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
#9 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
#10 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#11 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)

H4sIHIpgATW/JicAAADjAAEBCgEZGii/GgAJASczACgpPgEBAQH/CAH/Jwr/swooJyECAAAB/gAB
/wFmY3D9AAAAAQAAAAAAmAAAAAAAOxgAACkAANYAAIABZAACACQwAQACAAAAAP46hRQAAACUJwAA
BAAAAGgKRidSASkAAAIQAAAEIABzCicqJaQtUwEA6AAAAA==

Kostya Serebryany <kcc>
Project Member
Sat 03 Oct 2015 07:13:46 PM UTC, comment #1:

Thanks for the report. Should be fixed in git, please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 03 Oct 2015 08:03:55 AM UTC, original submission:

found with libFuzzer+MemorySanitizer

==11865==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f088d2b7db5 in pcf_read_TOC src/pcf/pcfread.c:105:59
#1 0x7f088d2b7db5 in pcf_load_font src/pcf/pcfread.c:1183
#2 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#3 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
#4 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#5 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#6 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
#7 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
#8 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#9 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

Uninitialized value was stored to memory at
#0 0x7f088d07ad20 in FT_Stream_ReadFields src/base/ftstream.c:843:23
#1 0x7f088d2b12b2 in pcf_read_TOC src/pcf/pcfread.c:102:10
#2 0x7f088d2b12b2 in pcf_load_font src/pcf/pcfread.c:1183
#3 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#4 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
#5 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#6 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#7 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
#8 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
#9 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#10 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

Uninitialized value was stored to memory at
#0 0x7f088cf76187 in __msan_memcpy /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1485:3
#1 0x7f088d4c4c27 in ft_gzip_file_io src/gzip/ftgzip.c:516:7
#2 0x7f088d074cf0 in FT_Stream_EnterFrame src/base/ftstream.c:273:20
#3 0x7f088d07b2e7 in FT_Stream_ReadFields src/base/ftstream.c:742:17
#4 0x7f088d2b12b2 in pcf_read_TOC src/pcf/pcfread.c:102:10
#5 0x7f088d2b12b2 in pcf_load_font src/pcf/pcfread.c:1183
#6 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
#7 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
#8 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#9 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#10 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
#11 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
#12 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#13 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

Uninitialized value was created by a heap allocation
#0 0x7f088cf7d392 in malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1002:3
#1 0x7f088d54f753 in ft_alloc builds/unix/ftsystem.c:102:12
#2 0x7f088d075e8c in ft_mem_qalloc src/base/ftutil.c:76:15
#3 0x7f088d4c0b1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:631:11
#4 0x7f088d2a8da0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
#5 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
#6 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
#7 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#8 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
#9 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
#10 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#11 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

Valgrind/memcheck agrees:
==12173== Conditional jump or move depends on uninitialised value(s)
==12173== at 0x43FDCA: pcf_read_TOC (pcfread.c:105)
==12173== by 0x43FDCA: pcf_load_font (pcfread.c:1183)
==12173== by 0x441BCA: PCF_Face_Init (pcfdrivr.c:335)
==12173== by 0x410C81: open_face (ftobjs.c:1166)
==12173== by 0x412FF7: FT_Open_Face (ftobjs.c:2164)
==12173== by 0x413903: FT_New_Memory_Face (ftobjs.c:1256)
==12173== by 0x4078EA: TestOneInput (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173== by 0x407B33: main (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173== Uninitialised value was created by a heap allocation
==12173== at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==12173== by 0x40FEF4: ft_mem_qalloc (ftutil.c:76)
==12173== by 0x464F21: FT_Stream_OpenGzip (ftgzip.c:631)
==12173== by 0x441BA9: PCF_Face_Init (pcfdrivr.c:289)
==12173== by 0x410C81: open_face (ftobjs.c:1166)
==12173== by 0x412FF7: FT_Open_Face (ftobjs.c:2164)
==12173== by 0x413903: FT_New_Memory_Face (ftobjs.c:1256)
==12173== by 0x4078EA: TestOneInput (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173== by 0x407B33: main (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)

Reproducer:
H4sICmABKL8oJwBwAAAo5AEBCgH/CAFbvxonrwEhoCoYLAEBAQH8KL8KJwH/CgA7AgEAAf4AAf8B
ZmNwEQAAAAEqAAAAAACYAAAAJx0AKQIAAHEAAAgAAQAhKmQAAgAwAAABAABlACUIASFGb250Knlw
ZTAtMS4w0SAvVFRBNUE5ECVGKlNkAC0AAEE6AAFvYmVGAAA=

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35063:  5518286e03c1377ba9e648a4e46e57f104b013fd added by kcc (197B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 04 Oct 2015 08:50:03 PM UTCwlStatusNeed Info=>Fixed
    Sun 04 Oct 2015 06:58:11 PM UTCkccAttached File-=>Added 5518286e03c1377ba9e648a4e46e57f104b013fd, #35063
    Sun 04 Oct 2015 11:19:28 AM UTCwlStatusFixed=>Need Info
    Sat 03 Oct 2015 07:13:46 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.1

    Back to the top


    Powered by Savane 3.1-cleanup1