bugThe FreeType Project - Bugs: bug #46635, Read of random pointer in minimal...

 
 

bug #46635: Read of random pointer in minimal configuration.

Submitted by:  bungeman <bungeman>
Submitted on:  Tue 08 Dec 2015 04:36:12 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 14 Dec 2015 06:52:00 AM UTC, comment #4:

Applied, thanks!

Regarding an additional check for FT_ALLOC: As far as I can see, `length' is already checked while scanning the font's table directory, so there won't be an allocation of `lots of ram'.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 10 Dec 2015 09:29:27 PM UTC, comment #3:

I'm now pretty sure that this patch is the right way to fix this. ft_lookup_PS_in_sfnt_stream blindly returns 'offset' and 'length' as reported from the font data, so seeking to that offset needs to be checked. In addition, it might be beneficial to also check that 'pos + offset + length < stream->size' before the FT_ALLOC a few lines down, but it might be ok to just let malformed fonts allocate (or fail to allocate) lots of ram and then immediately free it (when the subsequent read fails to read all of those bytes).

I'm attaching a 'git format-patch' for this.

(file #35693)

bungeman <bungeman>
Tue 08 Dec 2015 08:23:24 PM UTC, comment #2:

The attached patch resolves this issue in my local build.

(file #35671)

bungeman <bungeman>
Tue 08 Dec 2015 08:13:07 PM UTC, comment #1:

In this particular case, the issue is the stack trace

#0 open_face_PS_from_sfnt_stream
(library=0x61300000de80, stream=0x60700000dfb0, face_index=0, num_params=0, params=0x0, aface=0x7fffffffcfe0)
src/freetype2/src/base/ftobjs.c:1525

#1 Mac_Read_sfnt_Resource
(library=0x61300000de80, stream=0x60700000dfb0, offsets=0x60200000efb0, resource_cnt=1, face_index=0, aface=0x7fffffffcfe0)
src/freetype2/src/base/ftobjs.c:1796

#2 IsMacResource
(library=0x61300000de80, stream=0x60700000dfb0, resource_offset=0, face_index=-1, aface=0x7fffffffcfe0)
src/base/ftobjs.c:1880

open_face_PS_from_sfnt_stream fails 'if ( FT_Stream_Seek( stream, pos + offset ) )' and exits, but does not set any error code. It appears that at ftobjs.c:1525 'error' should be set.

bungeman <bungeman>
Tue 08 Dec 2015 04:36:12 PM UTC, original submission:

This was found while attempting to run KLEE with FreeType ( b38ca3cbebd1da222dec4ebff0560cfe9a6802c9 ). The configuration used here is minimal (to reduce the state space) and appears to be relevant. The modules.cfg file in this case has been modified to comment out everything except

FONT_MODULES += pfr
RASTER_MODULES += raster

Klee reports

and produces the attached 'test000605' input.

Building with the above minimal modules.cfg and AddressSanitizer then running the result with the attached input produces the following.

It appears that 'aface' isn't properly set, but there is no error reported, so it is used anyway.

bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35667:  test000605 added by bungeman (992B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 14 Dec 2015 06:52:00 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.3
    Thu 10 Dec 2015 09:29:27 PM UTCbungemanAttached File-=>Added 0001-base-Check-error-when-seeking-to-data-supplied-offse.patch, #35693
    Tue 08 Dec 2015 08:23:24 PM UTCbungemanAttached File-=>Added report_error_from_seek.patch, #35671
    Tue 08 Dec 2015 04:36:12 PM UTCbungemanAttached File-=>Added test000605, #35667

    Back to the top


    Powered by Savane 3.1-cleanup1