Sat 31 Oct 2015 10:55:34 AM UTC, original submission:
The following infinite recursion crash has been encountered in FreeType while fuzzing TrueType fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
$ ftbench <file>
Attached is a POC file which triggers the condition.
---
$ freetype2-demos/bin/ftbench signal_sigsegv_7833bc_1476_93c98e80bf174d0ca3897ef81de1ecc6
ftbench results for font `signal_sigsegv_7833bc_1476_93c98e80bf174d0ca3897ef81de1ecc6'
--------------------------------------------------------------------------------------
family: Osaka-Mono
style: Regular-M
number of seconds for each test: 2.000000
starting glyph index: 0
face size: 10ppem
font preloading into memory: no
load flags: 0x0
render mode: 0
CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte
executing tests:
Load ASAN:DEADLYSIGNAL
=================================================================
==18422==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000069a4f9 bp 0x7ffc54cb98f0 sp 0x7ffc54cb9760 T0)
#0 0x69a4f8 in tt_sbit_decoder_load_bit_aligned freetype2/src/sfnt/ttsbit.c:825:19
#1 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#2 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#3 0x69b0d3 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:922:15
#4 0x699416 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1127:15
#5 0x6973f6 in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1315:12
#6 0x68564f in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1480:19
#7 0x559825 in load_sbit_image freetype2/src/truetype/ttgload.c:2101:13
#8 0x5584bc in TT_Load_Glyph freetype2/src/truetype/ttgload.c:2448:15
#9 0x52c782 in tt_glyph_load freetype2/src/truetype/ttdriver.c:396:13
#10 0x4ede8e in FT_Load_Glyph freetype2/src/base/ftobjs.c:742:15
#11 0x4e5c4e in test_load freetype2-demos/src/ftbench.c:250:13
#12 0x4e621f in benchmark freetype2-demos/src/ftbench.c:216:15
#13 0x4e46c9 in main freetype2-demos/src/ftbench.c:1058:9
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV freetype2/src/sfnt/ttsbit.c:825:19 in tt_sbit_decoder_load_bit_aligned
==18422==ABORTING
---
|