bugThe FreeType Project - Bugs: bug #46229, Memory leak in T1_Read_Metrics...

 
 

bug #46229: Memory leak in T1_Read_Metrics when attaching files.

Submitted by:  bungeman <bungeman>
Submitted on:  Fri 16 Oct 2015 06:33:57 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 20 Oct 2015 08:55:05 PM UTC, comment #2:

Using tar is a fine trick. But It will also stress tar itself and will waste some time on it.

We don't have a really easy way to fuzz combinations of multiple
inputs. However, we have a way to implement more custom logic,
including your own custom mutators. See
https://github.com/llvm-mirror/llvm/blob/master/lib/Fuzzer/test/UserSuppliedFuzzerTest.cpp

There the target function is not just a function, but a member of a class which also redefines the Mutate method.
So, in your custom mutator you may
- untar the file (which is a valid tar archive)
- mutate every file in the archive separately
- tar it back for storage.

We don't have a more convenient way yet, but your request is not unique.

Kostya Serebryany <kcc>
Project Member
Tue 20 Oct 2015 05:09:11 AM UTC, comment #1:

Memory leak now fixed in git, thanks.

The tar experiment looks nice! However, how are you going to create those files in an automated way? I guess that you can't fuzz the archive itself since there are checksums or something similar to make libarchive reject malformed files.

What about adding a command-line option to the fuzzer to pass a directory for files that should be attached?

I've CCed Kostya for another opinion.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 16 Oct 2015 06:33:57 PM UTC, original submission:

This was found while working on extending ftfuzzer.cc for libFuzzer, but appears to happen naturally (I haven't even started running the fuzzer with these changes yet, just testing with runinput).

The attached fuzzer_add_tar_support.diff is an experimental attempt to add 'tar' as an input format so that the fuzzer can provide multiple 'files' as input. Note that this requires libarchive headers to be available. If the data cannot be decoded as 'tar' it just uses the whole file as input. If the data can be decoded as 'tar' then the first file is used to create the face, and the rest are attached to the face. This should allow at least some fuzzing of pfb/afm/pfm fonts.

The attached a010013l.tar file was created on an Ubuntu box with the gsfonts package installed (these appear to be GPL with font exception) by running

tar -cf a010013l.tar /usr/share/fonts/type1/gsfonts/a010013l.pfb /usr/share/fonts/type1/gsfonts/a010013l.afm /usr/share/fonts/type1/gsfonts/a010013l.pfm

note that the pfb needs to be first here.

Introduction aside, this detected a leak on the first test run (with what looks like valid input). The leak is reported as:

ERROR: LeakSanitizer: detected memory leaks

Direct leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x4ade2b in __interceptor_malloc src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40:3
#1 0x5e9191 in ft_mem_qalloc src/freetype2/src/base/ftutil.c:76:15
#2 0x5e9191 in ft_mem_alloc src/freetype2/src/base/ftutil.c:55
#3 0x841c29 in T1_Read_Metrics src/freetype2/src/type1/t1afm.c:245:10
#4 0x5fd7a6 in FT_Attach_Stream src/freetype2/src/base/ftobjs.c:2397:15
#5 0x4d966f in LLVMFuzzerTestOneInput src/freetype2/src/tools/ftfuzzer/ftfuzzer.cc:200:11
#6 0x4eaa6b in main src/freetype2/src/tools/ftfuzzer/runinput.cc:37:7
#7 0x7ffff60a7ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287

Indirect leak of 15728 byte(s) in 1 object(s) allocated from:
#0 0x4ade2b in __interceptor_malloc src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40:3
#1 0x637bc1 in ft_mem_qalloc src/freetype2/src/base/ftutil.c:76:15
#2 0x637bc1 in ft_mem_alloc src/freetype2/src/base/ftutil.c:55
#3 0x637bc1 in ft_mem_qrealloc src/freetype2/src/base/ftutil.c:146
#4 0x5ea13e in ft_mem_realloc src/freetype2/src/base/ftutil.c:102:13
#5 0x6fbfc0 in afm_parse_kern_pairs src/freetype2/src/psaux/afmparse.c:714:12
#6 0x6fbfc0 in afm_parse_kern_data src/freetype2/src/psaux/afmparse.c:807
#7 0x6fbfc0 in afm_parser_parse src/freetype2/src/psaux/afmparse.c:951
#8 0x841fff in T1_Read_Metrics src/freetype2/src/type1/t1afm.c:267:17
#9 0x5fd7a6 in FT_Attach_Stream src/freetype2/src/base/ftobjs.c:2397:15
#10 0x4d966f in LLVMFuzzerTestOneInput src/freetype2/src/tools/ftfuzzer/ftfuzzer.cc:200:11
#11 0x4eaa6b in main src/freetype2/src/tools/ftfuzzer/runinput.cc:37:7
#12 0x7ffff60a7ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287

I think what is happening here is that I've attached both an afm and a pfm, so the first one leaks when the second is applied.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35213:  a010013l.tar added by bungeman (120KiB - application/x-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kcc (Posted a comment)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by wl
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 20 Oct 2015 05:09:11 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
      Carbon-Copy-=>Added kcc
    Fri 16 Oct 2015 06:33:57 PM UTCbungemanAttached File-=>Added a010013l.tar, #35213
      Attached File-=>Added fuzzer_add_tar_support.diff, #35214

    Back to the top


    Powered by Savane 3.1-cleanup1