Wed 21 Oct 2015 05:22:48 PM UTC, original submission:
Found with libFuzzer+AddressSanitizer with FreeType 3cfd51233c8b88f53097ebcef6bbb05e360d12b7, reproduction attached. This appears to be a read off the end of the input. The error is reported as:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6230001a743a at pc 0x000000895f6d bp 0x7ffc560afaf0 sp 0x7ffc560afae8
READ of size 1 at 0x6230001a743a thread T0
#0 0x895f6c in t42_parse_sfnts src/freetype2/src/type42/t42parse.c:685:39
#1 0x887f15 in t42_load_keyword src/freetype2/src/type42/t42parse.c:1082:7
#2 0x887f15 in t42_parse_dict src/freetype2/src/type42/t42parse.c:1229
#3 0x887f15 in T42_Open_Face src/freetype2/src/type42/t42objs.c:63
#4 0x887f15 in T42_Face_Init src/freetype2/src/type42/t42objs.c:202
#5 0x5f8019 in open_face src/freetype2/src/base/ftobjs.c:1177:15
#6 0x5f4fba in FT_Open_Face src/freetype2/src/base/ftobjs.c:2175:19
#7 0x5f77ac in FT_New_Memory_Face src/freetype2/src/base/ftobjs.c:1267:12
#8 0x4daa5b in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4daa5b)
0x6230001a743a is located 0 bytes to the right of 5946-byte region [0x6230001a5d00,0x6230001a743a)
allocated by thread T0 here:
#0 0x4d87eb in operator new(unsigned long) src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
#1 0x4e4191 in __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) (fuzz_freetype/freetype2_fuzzer+0x4e4191)
#2 0x4e1654 in std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4e1654)
#3 0x4e8d61 in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_range_initialize<unsigned char const>(unsigned char const, unsigned char const*, std::forward_iterator_tag) (fuzz_freetype/freetype2_fuzzer+0x4e8d61)
#4 0x4e8b8b in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_initialize_dispatch<unsigned char const>(unsigned char const, unsigned char const*, std::__false_type) (fuzz_freetype/freetype2_fuzzer+0x4e8b8b)
#5 0x4e890c in std::vector<unsigned char, std::allocator<unsigned char> >::vector<unsigned char const, void>(unsigned char const, unsigned char const*, std::allocator<unsigned char> const&) (fuzz_freetype/freetype2_fuzzer+0x4e890c)
#6 0x4e8737 in void __gnu_cxx::new_allocator<std::vector<unsigned char, std::allocator<unsigned char> > >::construct<std::vector<unsigned char, std::allocator<unsigned char> >, unsigned char const&, unsigned char const>(std::vector<unsigned char, std::allocator<unsigned char> >, unsigned char const&, unsigned char const*&&) (fuzz_freetype/freetype2_fuzzer+0x4e8737)
#7 0x4e854b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE12_S_constructIS2_JRPKhS7_EEENSt9enable_ifIXsr18__construct_helperIT_DpT0_EE5valueEvE4typeERS3_PSA_DpOSB (fuzz_freetype/freetype2_fuzzer+0x4e854b)
#8 0x4e7c6b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE9constructIS2_JRPKhS7_EEEDTcl12_S_constructfp_fp0_spclsr3stdE7forwardIT0_Efp1_EEERS3_PT_DpOS9 (fuzz_freetype/freetype2_fuzzer+0x4e7c6b)
#9 0x4e7dfa in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::_M_emplace_back_aux<unsigned char const&, unsigned char const>(unsigned char const&, unsigned char const&&) (fuzz_freetype/freetype2_fuzzer+0x4e7dfa)
#10 0x4de511 in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::emplace_back<unsigned char const&, unsigned char const>(unsigned char const&, unsigned char const&&) (fuzz_freetype/freetype2_fuzzer+0x4de511)
#11 0x4dc5d4 in parse_data(unsigned char const*, unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4dc5d4)
#12 0x4da96d in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4da96d)
SUMMARY: AddressSanitizer: heap-buffer-overflow src/freetype2/src/type42/t42parse.c:685:39 in t42_parse_sfnts
Shadow bytes around the buggy address:
0x0c468002ce30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c468002ce70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c468002ce80: 00 00 00 00 00 00 00[02]fa fa fa fa fa fa fa fa
0x0c468002ce90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002cea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002ceb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002cec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c468002ced0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
|