bugThe FreeType Project - Bugs: bug #46269, Heap buffer overflow in...

 
 

bug #46269: Heap buffer overflow in t42_parse_sfnts on malformed Type42 font.

Submitted by:  bungeman <bungeman>
Submitted on:  Wed 21 Oct 2015 05:22:48 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 21 Oct 2015 06:30:18 PM UTC, comment #1:

Fixed in git, thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 21 Oct 2015 05:22:48 PM UTC, original submission:

Found with libFuzzer+AddressSanitizer with FreeType 3cfd51233c8b88f53097ebcef6bbb05e360d12b7, reproduction attached. This appears to be a read off the end of the input. The error is reported as:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6230001a743a at pc 0x000000895f6d bp 0x7ffc560afaf0 sp 0x7ffc560afae8
READ of size 1 at 0x6230001a743a thread T0
#0 0x895f6c in t42_parse_sfnts src/freetype2/src/type42/t42parse.c:685:39
#1 0x887f15 in t42_load_keyword src/freetype2/src/type42/t42parse.c:1082:7
#2 0x887f15 in t42_parse_dict src/freetype2/src/type42/t42parse.c:1229
#3 0x887f15 in T42_Open_Face src/freetype2/src/type42/t42objs.c:63
#4 0x887f15 in T42_Face_Init src/freetype2/src/type42/t42objs.c:202
#5 0x5f8019 in open_face src/freetype2/src/base/ftobjs.c:1177:15
#6 0x5f4fba in FT_Open_Face src/freetype2/src/base/ftobjs.c:2175:19
#7 0x5f77ac in FT_New_Memory_Face src/freetype2/src/base/ftobjs.c:1267:12
#8 0x4daa5b in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4daa5b)

0x6230001a743a is located 0 bytes to the right of 5946-byte region [0x6230001a5d00,0x6230001a743a)
allocated by thread T0 here:
#0 0x4d87eb in operator new(unsigned long) src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
#1 0x4e4191 in __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) (fuzz_freetype/freetype2_fuzzer+0x4e4191)
#2 0x4e1654 in std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4e1654)
#3 0x4e8d61 in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_range_initialize<unsigned char const>(unsigned char const, unsigned char const*, std::forward_iterator_tag) (fuzz_freetype/freetype2_fuzzer+0x4e8d61)
#4 0x4e8b8b in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_initialize_dispatch<unsigned char const>(unsigned char const, unsigned char const*, std::__false_type) (fuzz_freetype/freetype2_fuzzer+0x4e8b8b)
#5 0x4e890c in std::vector<unsigned char, std::allocator<unsigned char> >::vector<unsigned char const, void>(unsigned char const, unsigned char const*, std::allocator<unsigned char> const&) (fuzz_freetype/freetype2_fuzzer+0x4e890c)
#6 0x4e8737 in void __gnu_cxx::new_allocator<std::vector<unsigned char, std::allocator<unsigned char> > >::construct<std::vector<unsigned char, std::allocator<unsigned char> >, unsigned char const&, unsigned char const>(std::vector<unsigned char, std::allocator<unsigned char> >, unsigned char const&, unsigned char const*&&) (fuzz_freetype/freetype2_fuzzer+0x4e8737)
#7 0x4e854b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE12_S_constructIS2_JRPKhS7_EEENSt9enable_ifIXsr18__construct_helperIT_DpT0_EE5valueEvE4typeERS3_PSA_DpOSB (fuzz_freetype/freetype2_fuzzer+0x4e854b)
#8 0x4e7c6b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE9constructIS2_JRPKhS7_EEEDTcl12_S_constructfp_fp0_spclsr3stdE7forwardIT0_Efp1_EEERS3_PT_DpOS9 (fuzz_freetype/freetype2_fuzzer+0x4e7c6b)
#9 0x4e7dfa in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::_M_emplace_back_aux<unsigned char const&, unsigned char const>(unsigned char const&, unsigned char const&&) (fuzz_freetype/freetype2_fuzzer+0x4e7dfa)
#10 0x4de511 in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::emplace_back<unsigned char const&, unsigned char const>(unsigned char const&, unsigned char const&&) (fuzz_freetype/freetype2_fuzzer+0x4de511)
#11 0x4dc5d4 in parse_data(unsigned char const*, unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4dc5d4)
#12 0x4da96d in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4da96d)

SUMMARY: AddressSanitizer: heap-buffer-overflow src/freetype2/src/type42/t42parse.c:685:39 in t42_parse_sfnts
Shadow bytes around the buggy address:
0x0c468002ce30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c468002ce80: 00 00 00 00 00 00 00[02]fa fa fa fa fa fa fa fa
0x0c468002ce90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002cea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002ceb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002cec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002ced0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 21 Oct 2015 06:30:18 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Wed 21 Oct 2015 05:22:48 PM UTCbungemanAttached File-=>Added crash-6b412a1e430ee411034db5959e5d3978e898e2aa, #35249

    Back to the top


    Powered by Savane 3.1-cleanup1