Thu 10 Dec 2015 09:29:27 PM UTC, comment #3:
I'm now pretty sure that this patch is the right way to fix this. ft_lookup_PS_in_sfnt_stream blindly returns 'offset' and 'length' as reported from the font data, so seeking to that offset needs to be checked. In addition, it might be beneficial to also check that 'pos + offset + length < stream->size' before the FT_ALLOC a few lines down, but it might be ok to just let malformed fonts allocate (or fail to allocate) lots of ram and then immediately free it (when the subsequent read fails to read all of those bytes).
I'm attaching a 'git format-patch' for this.
(file #35693)
|
Tue 08 Dec 2015 08:13:07 PM UTC, comment #1:
In this particular case, the issue is the stack trace
#0 open_face_PS_from_sfnt_stream
(library=0x61300000de80, stream=0x60700000dfb0, face_index=0, num_params=0, params=0x0, aface=0x7fffffffcfe0)
src/freetype2/src/base/ftobjs.c:1525
#1 Mac_Read_sfnt_Resource
(library=0x61300000de80, stream=0x60700000dfb0, offsets=0x60200000efb0, resource_cnt=1, face_index=0, aface=0x7fffffffcfe0)
src/freetype2/src/base/ftobjs.c:1796
#2 IsMacResource
(library=0x61300000de80, stream=0x60700000dfb0, resource_offset=0, face_index=-1, aface=0x7fffffffcfe0)
src/base/ftobjs.c:1880
open_face_PS_from_sfnt_stream fails 'if ( FT_Stream_Seek( stream, pos + offset ) )' and exits, but does not set any error code. It appears that at ftobjs.c:1525 'error' should be set.
|
Tue 08 Dec 2015 04:36:12 PM UTC, original submission:
This was found while attempting to run KLEE with FreeType ( b38ca3cbebd1da222dec4ebff0560cfe9a6802c9 ). The configuration used here is minimal (to reduce the state space) and appears to be relevant. The modules.cfg file in this case has been modified to comment out everything except
FONT_MODULES += pfr
RASTER_MODULES += raster
Klee reports
and produces the attached 'test000605' input.
Building with the above minimal modules.cfg and AddressSanitizer then running the result with the attached input produces the following.
It appears that 'aface' isn't properly set, but there is no error reported, so it is used anyway.
|