bugThe FreeType Project - Bugs: bug #46217, Leak in _bdf_parse_glyphs on...

 
 

bug #46217: Leak in _bdf_parse_glyphs on malformed bdf font.

Submitted by:  bungeman <bungeman>
Submitted on:  Thu 15 Oct 2015 08:27:42 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 17 Oct 2015 12:22:47 PM UTC, comment #2:

Fixed in git. Thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 15 Oct 2015 08:46:06 PM UTC, comment #1:

It appears that what is happening is that for the first glyph in this 'font' the assignment

1750 glyph->name = p->glyph_name;

happens twice, the first time setting the glyph->name, the second time setting it back to NULL (since p->glyph_name was set to NULL the first time around).

bungeman <bungeman>
Thu 15 Oct 2015 08:27:42 PM UTC, original submission:

While fuzzing the following leak was detected:

ERROR: LeakSanitizer: detected memory leaks
Direct leak of 2 byte(s) in 1 object(s) allocated from:

__interceptor_malloc src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40:3
ft_mem_qalloc src/freetype2/src/base/ftutil.c:76:15
ft_mem_alloc src/freetype2/src/base/ftutil.c:55:0
ft_mem_qrealloc src/freetype2/src/base/ftutil.c:146:0
ft_mem_realloc src/freetype2/src/base/ftutil.c:102:13
_bdf_parse_glyphs src/freetype2/src/bdf/bdflib.c:1663:12
_bdf_readstream src/freetype2/src/bdf/bdflib.c:788:17
bdf_load_font src/freetype2/src/bdf/bdflib.c:2454:0
BDF_Face_Init src/freetype2/src/bdf/bdfdrivr.c:364:0
open_face src/freetype2/src/base/ftobjs.c:1177:15
FT_Open_Face src/freetype2/src/base/ftobjs.c:2175:19
FT_New_Memory_Face src/freetype2/src/base/ftobjs.c:1267:12
LLVMFuzzerTestOneInput

The allocation in _bdf_parse_glyphs "FT_NEW_ARRAY( p->glyph_name, slen + 1 )" isn't getting freed, though I have not yet determined why. The reproducing malformed bdf font file is attached. These tend to be small leaks, but some fonts exhibit the issue multiple times which leads to much larger leaks.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35205:  f0533a1abd24d607de9a682db9865465ec323b72 added by bungeman (7KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 17 Oct 2015 12:22:47 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Thu 15 Oct 2015 08:27:42 PM UTCbungemanAttached File-=>Added f0533a1abd24d607de9a682db9865465ec323b72, #35205

    Back to the top


    Powered by Savane 3.1-cleanup1