bugThe FreeType Project - Bugs: bug #46344, FreeType 2.6.1 TrueType parsing...

 
 

bug #46344: FreeType 2.6.1 TrueType parsing infinite recursion in "tt_sbit_decoder_load_image"

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Sat 31 Oct 2015 10:42:57 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 31 Oct 2015 04:54:22 PM UTC, comment #1:

Fixed in git, thanks for the report.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 31 Oct 2015 10:42:57 AM UTC, original submission:

The following infinite recursion crash has been encountered in FreeType while fuzzing TrueType fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are three POC files which trigger the condition.

---
$ freetype2-demos/bin/ftbench asan_asan-generic_425748_1066_a17e16dca35991b942435605b21b4843

ftbench results for font `asan_asan-generic_425748_1066_a17e16dca35991b942435605b21b4843'
-----------------------------------------------------------------------------------------

family: (null)
style: (null)

number of seconds for each test: 2.000000

starting glyph index: 0
face size: 10ppem
font preloading into memory: no

load flags: 0x0
render mode: 0

CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte

executing tests:
Load ASAN:DEADLYSIGNAL
=================================================================
==18134==ERROR: AddressSanitizer: stack-overflow on address 0x7fff16618ea8 (pc 0x0000004b8902 bp 0x7fff166196f0 sp 0x7fff16618e80 T0)
#0 0x4b8901 in malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:39
#1 0x74fa60 in ft_alloc freetype2/src/base/ftsystem.c:74:12
#2 0x517ac7 in ft_mem_qalloc freetype2/src/base/ftutil.c:76:15
#3 0x517191 in FT_Stream_EnterFrame freetype2/src/base/ftstream.c:269:12
#4 0x516de0 in FT_Stream_ExtractFrame freetype2/src/base/ftstream.c:200:13
#5 0x698eb4 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1018:10
#6 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#7 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#8 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#9 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#10 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#11 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#12 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#13 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#14 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#15 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#16 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#17 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#18 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#19 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#20 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#21 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#22 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#23 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#24 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#25 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
[...]

SUMMARY: AddressSanitizer: stack-overflow llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:39 in malloc
==18134==ABORTING
---

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 31 Oct 2015 04:54:22 PM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Sat 31 Oct 2015 10:42:57 AM UTCj00ruAttached File-=>Added asan_asan-generic_425748_1066_a17e16dca35991b942435605b21b4843, #35342
      Attached File-=>Added asan_asan-generic_42578c_4314_a501f0982ee811d85c3ea819c70a6a38, #35343
      Attached File-=>Added asan_asan-generic_53dd57_1066_e42320b0973225ca9f7d996f7ff26780, #35344

    Back to the top


    Powered by Savane 3.1-cleanup1