bugThe FreeType Project - Bugs: bug #46213, Leak in malformed bdf font.

 
 

bug #46213: Leak in malformed bdf font.

Submitted by:  bungeman <bungeman>
Submitted on:  Thu 15 Oct 2015 03:08:05 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 16 Oct 2015 04:41:14 AM UTC, comment #3:

adding "found by libFuzzer" for bookkeeping :)

Kostya Serebryany <kcc>
Project Member
Thu 15 Oct 2015 10:01:46 PM UTC, comment #2:

I've applied your (verbal) patch to the git repository, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 15 Oct 2015 05:38:05 PM UTC, comment #1:

I locally hacked in the the 'if (p->font != 0) goto Fail;' to the two locations in bdf_load_font which appeared to need it. After doing so the fuzzer is far less memory hungry. Fixing this leak should unblock adding fixed sizes to the fuzzer https://savannah.nongnu.org/bugs/?func=detailitem&item_id=46211 .

bungeman <bungeman>
Thu 15 Oct 2015 03:08:05 PM UTC, original submission:

With the fuzzer.diff attached to https://savannah.nongnu.org/bugs/?func=detailitem&item_id=46211 applied at FreeType 2a20c92c4bd022923885252ec9264642533ba809 the fuzzer created the attached malformed bdf font which leaks memory.

==29832==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 557352 byte(s) in 1 object(s) allocated from:
__interceptor_malloc /usr/local/google/home/bungeman/src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40:3
ft_mem_qalloc /usr/local/google/home/bungeman/src/freetype2/src/base/ftutil.c:76:15
ft_mem_alloc /usr/local/google/home/bungeman/src/freetype2/src/base/ftutil.c:55:0
_bdf_parse_start /usr/local/google/home/bungeman/src/freetype2/src/bdf/bdflib.c:2196:12
_bdf_readstream /usr/local/google/home/bungeman/src/freetype2/src/bdf/bdflib.c:788:17
bdf_load_font /usr/local/google/home/bungeman/src/freetype2/src/bdf/bdflib.c:2454:0
BDF_Face_Init /usr/local/google/home/bungeman/src/freetype2/src/bdf/bdfdrivr.c:364:0
open_face /usr/local/google/home/bungeman/src/freetype2/src/base/ftobjs.c:1166:15
FT_Open_Face /usr/local/google/home/bungeman/src/freetype2/src/base/ftobjs.c:2164:19
FT_New_Memory_Face /usr/local/google/home/bungeman/src/freetype2/src/base/ftobjs.c:1256:12
LLVMFuzzerTestOneInput

There are also a large number of indirect leaks through this one. It appears that in _bdf_parse_start 'font' is allocated and stored in the 'client_data' (through 'p'). If an error is reported it should propagates up through to bdf_load_font which should then free the memory. I took a quick look at this in gdb, setting a breakpoint at bdflib.c:2196 and then setting a watchpoint with 'watch -l ((_bdf_parse_t *)client_data).font' shows that p->font is assigned just that once.

After some more tracing it appears that the issue is that the two 'goto Exit;' toward the bottom of bdf_load_font should be 'goto Fail;' when 'p->font != 0'.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kcc (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 15 Oct 2015 10:01:46 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Thu 15 Oct 2015 03:08:05 PM UTCbungemanAttached File-=>Added slow-unit-d7540d29a51363f6731d1f4de69013e167f9df0a, #35201

    Back to the top


    Powered by Savane 3.1-cleanup1