bugThe FreeType Project - Bugs: bug #46732, leak in FT_Open_Face

 
 

bug #46732: leak in FT_Open_Face

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Mon 21 Dec 2015 03:59:57 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.3

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 21 Dec 2015 07:48:01 PM UTC, comment #3:

Confirmed, the bot is happy now, thanks!

Kostya Serebryany <kcc>
Project Member
Mon 21 Dec 2015 04:27:55 PM UTC, comment #2:

Fixed now in git. Thanks for the report!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 21 Dec 2015 04:45:53 AM UTC, comment #1:

This is certainly a recent regression; will check it soon.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 21 Dec 2015 03:59:57 AM UTC, original submission:

Found by libFuzzer bot + AddressSanitizer

Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x4b618b in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
#1 0x51c01e in ft_mem_qalloc src/base/ftutil.c:76:15
#2 0x51c01e in ft_mem_alloc src/base/ftutil.c:55
#3 0x5de8ff in parse_subrs src/type1/t1load.c:1461:14
#4 0x5d897b in t1_load_keyword src/type1/t1load.c:952:7
#5 0x5d897b in parse_dict src/type1/t1load.c:2104
#6 0x5bf709 in T1_Open_Face src/type1/t1load.c:2206:13
#7 0x5bf709 in T1_Face_Init src/type1/t1objs.c:342
#8 0x52d465 in open_face src/base/ftobjs.c:1178:15
#9 0x529746 in FT_Open_Face src/base/ftobjs.c:2178:19
#10 0x52cd3c in FT_New_Memory_Face src/base/ftobjs.c:1268:12
#11 0x4e218f in LLVMFuzzerTestOneInput

Indirect leak of 1928 byte(s) in 1 object(s) allocated from:
#0 0x4b618b in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
#1 0x5216c4 in ft_mem_qalloc src/base/ftutil.c:76:15
#2 0x5216c4 in ft_mem_alloc src/base/ftutil.c:55
#3 0x5216c4 in ft_mem_qrealloc src/base/ftutil.c:146
#4 0x5216c4 in ft_mem_realloc src/base/ftutil.c:102
#5 0x5216c4 in ft_hash_init src/base/fthash.c:188
#6 0x5deaee in parse_subrs src/type1/t1load.c:1464:17
#7 0x5d897b in t1_load_keyword src/type1/t1load.c:952:7
#8 0x5d897b in parse_dict src/type1/t1load.c:2104
#9 0x5bf709 in T1_Open_Face src/type1/t1load.c:2206:13
#10 0x5bf709 in T1_Face_Init src/type1/t1objs.c:342
#11 0x52d465 in open_face src/base/ftobjs.c:1178:15
#12 0x529746 in FT_Open_Face src/base/ftobjs.c:2178:19
#13 0x52cd3c in FT_New_Memory_Face

Repro attached.

The bot has started reporting it just recently, but I don't know if this is a
recent regression or the bot has discovered something new after several weeks of silence.
WDYT?

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 21 Dec 2015 04:27:55 PM UTCwlStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.3
    Mon 21 Dec 2015 04:45:53 AM UTCwlAssigned toNone=>wl
    Mon 21 Dec 2015 03:59:57 AM UTCkccAttached File-=>Added CORPORA-C1-9fb7763a8b6dd59a5a1035726621965d78aaa95c, #35808

    Back to the top


    Powered by Savane 3.1-cleanup1