bugThe FreeType Project - Bugs: bug #46252, Enormous (144TB, arbitrary)...

 
 

bug #46252: Enormous (144TB, arbitrary) allocation in cid_read_subrs.

Submitted by:  bungeman <bungeman>
Submitted on:  Mon 19 Oct 2015 08:59:42 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 20 Oct 2015 08:36:35 PM UTC, comment #3:

Fixed differently with commit 3eccc3a3. Thanks for the report!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 19 Oct 2015 09:38:07 PM UTC, comment #2:

Note that I'm currently working around this killing the fuzzer workers by replacing the TODO comment below with

stream->size < data_len || stream->size - data_len < stream->pos

There may be tighter bounds.

bungeman <bungeman>
Mon 19 Oct 2015 09:10:02 PM UTC, comment #1:

It seems this needs to at least ensure that 'data_len' bytes actually exist in the stream before making the allocation. In other words, something like

data_len = offsets[num_subrs] - offsets[0];

+ if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
+ /* TODO: check data_len bytes exist to be read */ )
+ goto Fail;
+
if ( FT_NEW_ARRAY( subr->code, num_subrs + 1 ) ||
FT_ALLOC( subr->code[0], data_len ) )
goto Fail;

- if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
- FT_STREAM_READ( subr->code[0], data_len ) )
+ if ( FT_STREAM_READ( subr->code[0], data_len ) )
goto Fail;

I must admit I'm not sure of the FreeType idiomatic way of implementing the TODO here.

bungeman <bungeman>
Mon 19 Oct 2015 08:59:42 PM UTC, original submission:

Found with libFuzzer+AddressSanitizer, reproduction attached.

The attached cid font causes FreeType to attempt to allocate ~144TB. The report is:

WARNING: AddressSanitizer failed to allocate 0x837b01000000 bytes
AddressSanitizer CHECK failed: src/llvm_all/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:147 "((0)) != (0)" (0x0, x0)

ft_mem_qalloc src/freetype2/src/base/ftutil.c:76:15
ft_mem_alloc src/freetype2/src/base/ftutil.c:55:0
cid_read_subrs src/freetype2/src/cid/cidload.c:494:16
cid_face_open src/freetype2/src/cid/cidload.c:714:0
cid_face_init src/freetype2/src/cid/cidobjs.c:327:0
open_face src/freetype2/src/base/ftobjs.c:1177:15
FT_Open_Face src/freetype2/src/base/ftobjs.c:2175:19
FT_New_Memory_Face src/freetype2/src/base/ftobjs.c:1267:12
LLVMFuzzerTestOneInput

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 20 Oct 2015 08:36:35 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Mon 19 Oct 2015 08:59:43 PM UTCbungemanAttached File-=>Added crash-ee28578063fc2167017855b7c5c4606e996b7e02, #35231

    Back to the top


    Powered by Savane 3.1-cleanup1