bugThe FreeType Project - Bugs: bug #48122, heap-buffer-overflow in...

 
 

bug #48122: heap-buffer-overflow in Mac_Read_sfnt_Resource

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Sat 04 Jun 2016 12:06:39 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 04 Jun 2016 04:58:39 AM UTC, comment #1:

Fixed in git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 04 Jun 2016 12:06:39 AM UTC, original submission:

==30831==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009db0 at pc 0x000000561909 bp 0x7fff0dd94030 sp 0x7fff0dd94028
READ of size 8 at 0x612000009db0 thread T0
#0 0x561908 in Mac_Read_sfnt_Resource src/base/ftobjs.c:1799:29
#1 0x561908 in IsMacResource src/base/ftobjs.c:1896
#2 0x535d98 in load_mac_face src/base/ftobjs.c:2082:15
#3 0x535d98 in FT_Open_Face src/base/ftobjs.c:2235
#4 0x5384be in FT_New_Memory_Face src/base/ftobjs.c:1267:12
#5 0x4e8816 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:211:12

0x612000009db0 is located 16 bytes to the left of 272-byte region [0x612000009dc0,0x612000009ed0)
allocated by thread T0 here:
#0 0x4b9e1d in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
#1 0x556497 in ft_mem_qalloc src/base/ftutil.c:76:15
#2 0x556497 in ft_mem_alloc src/base/ftutil.c:55
#3 0x556497 in ft_mem_qrealloc src/base/ftutil.c:146
#4 0x556497 in ft_mem_realloc src/base/ftutil.c:102
#5 0x556497 in FT_Raccess_Get_DataOffsets src/base/ftrfork.c:246
#6 0x55f54f in IsMacResource src/base/ftobjs.c:1887:13
#7 0x535d98 in load_mac_face src/base/ftobjs.c:2082:15
#8 0x535d98 in FT_Open_Face src/base/ftobjs.c:2235
#9 0x5384be in FT_New_Memory_Face src/base/ftobjs.c:1267:12
#10 0x4e8816 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:211:12

repro attached.
Found by a private libFuzzer bot and originally filed here:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10
(not yet publicly visible)

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #37384:  fuzz-3-freetype2_fuzzer added by kcc (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 04 Jun 2016 04:58:39 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.4
    Sat 04 Jun 2016 12:06:39 AM UTCkccAttached File-=>Added fuzz-3-freetype2_fuzzer, #37384

    Back to the top


    Powered by Savane 3.1-cleanup1