bugThe FreeType Project - Bugs: bug #46345, FreeType 2.6.1 TrueType parsing...

 
 

bug #46345: FreeType 2.6.1 TrueType parsing NULL pointer dereference in "tt_sbit_decoder_load_bit_aligned"

Submitted by:  Mateusz Jurczyk <j00ru>
Submitted on:  Sat 31 Oct 2015 10:55:34 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 03 Nov 2015 04:31:52 PM UTC, comment #4:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 02 Nov 2015 10:42:08 AM UTC, comment #3:

Hmmm... the other one fails to upload for some reason, but I think one should be sufficient.

Mateusz Jurczyk <j00ru>
Project Member
Mon 02 Nov 2015 10:40:46 AM UTC, comment #2:

Whoops! Attached two testcases.

(file #35363)

Mateusz Jurczyk <j00ru>
Project Member
Sat 31 Oct 2015 04:56:56 PM UTC, comment #1:

No attachment :-)

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 31 Oct 2015 10:55:34 AM UTC, original submission:

The following infinite recursion crash has been encountered in FreeType while fuzzing TrueType fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached is a POC file which triggers the condition.

---
$ freetype2-demos/bin/ftbench signal_sigsegv_7833bc_1476_93c98e80bf174d0ca3897ef81de1ecc6

ftbench results for font `signal_sigsegv_7833bc_1476_93c98e80bf174d0ca3897ef81de1ecc6'
--------------------------------------------------------------------------------------

family: Osaka-Mono
style: Regular-M

number of seconds for each test: 2.000000

starting glyph index: 0
face size: 10ppem
font preloading into memory: no

load flags: 0x0
render mode: 0

CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte

executing tests:
Load ASAN:DEADLYSIGNAL
=================================================================
==18422==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000069a4f9 bp 0x7ffc54cb98f0 sp 0x7ffc54cb9760 T0)
#0 0x69a4f8 in tt_sbit_decoder_load_bit_aligned freetype2/src/sfnt/ttsbit.c:825:19
#1 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#2 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#3 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#4 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#5 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#6 0x68564f in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1480:19
#7 0x559825 in load_sbit_image freetype2/src/truetype/ttgload.c:2101:13
#8 0x5584bc in TT_Load_Glyph freetype2/src/truetype/ttgload.c:2448:15
#9 0x52c782 in tt_glyph_load freetype2/src/truetype/ttdriver.c:396:13
#10 0x4ede8e in FT_Load_Glyph freetype2/src/base/ftobjs.c:742:15
#11 0x4e5c4e in test_load freetype2-demos/src/ftbench.c:250:13
#12 0x4e621f in benchmark freetype2-demos/src/ftbench.c:216:15
#13 0x4e46c9 in main freetype2-demos/src/ftbench.c:1058:9

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV freetype2/src/sfnt/ttsbit.c:825:19 in tt_sbit_decoder_load_bit_aligned
==18422==ABORTING
---

Mateusz Jurczyk <j00ru>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by j00ru (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 03 Nov 2015 04:31:52 PM UTCwlStatusNeed Info=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Mon 02 Nov 2015 10:40:46 AM UTCj00ruAttached File-=>Added signal_sigsegv_7833bc_9078_fbc901829860625e3d156fced50cd1c0, #35363
    Sat 31 Oct 2015 04:56:56 PM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl

    Back to the top


    Powered by Savane 3.1-cleanup1