Sat 31 Oct 2015 10:42:57 AM UTC, original submission:
The following infinite recursion crash has been encountered in FreeType while fuzzing TrueType fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
$ ftbench <file>
Attached are three POC files which trigger the condition.
---
$ freetype2-demos/bin/ftbench asan_asan-generic_425748_1066_a17e16dca35991b942435605b21b4843
ftbench results for font `asan_asan-generic_425748_1066_a17e16dca35991b942435605b21b4843'
-----------------------------------------------------------------------------------------
family: (null)
style: (null)
number of seconds for each test: 2.000000
starting glyph index: 0
face size: 10ppem
font preloading into memory: no
load flags: 0x0
render mode: 0
CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte
executing tests:
Load ASAN:DEADLYSIGNAL
=================================================================
==18134==ERROR: AddressSanitizer: stack-overflow on address 0x7fff16618ea8 (pc 0x0000004b8902 bp 0x7fff166196f0 sp 0x7fff16618e80 T0)
#0 0x4b8901 in malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:39
#1 0x74fa60 in ft_alloc freetype2/src/base/ftsystem.c:74:12
#2 0x517ac7 in ft_mem_qalloc freetype2/src/base/ftutil.c:76:15
#3 0x517191 in FT_Stream_EnterFrame freetype2/src/base/ftstream.c:269:12
#4 0x516de0 in FT_Stream_ExtractFrame freetype2/src/base/ftstream.c:200:13
#5 0x698eb4 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1018:10
#6 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#7 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#8 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#9 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#10 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#11 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#12 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#13 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#14 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#15 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#16 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#17 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#18 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#19 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#20 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#21 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#22 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#23 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#24 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#25 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
[...]
SUMMARY: AddressSanitizer: stack-overflow llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:39 in malloc
==18134==ABORTING
---
|