bugThe FreeType Project - Bugs: bug #49393, null pointer passed as argument...

 
 

bug #49393: null pointer passed as argument which is declared to never be null in FT_Stream_ReadAt()

Submitted by:  Tyson Smith <twsmith>
Submitted on:  Thu 20 Oct 2016 04:42:17 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.7.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 22 Oct 2016 04:36:45 PM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 20 Oct 2016 04:42:17 PM UTC, original submission:

src/base/ftstream.c:145:7: runtime error: null pointer passed as argument 1, which is declared to never be null
Found while fuzzing with UBSan and FTFuzzer.

/usr/include/string.h:43:28: note: nonnull attribute specified here
#0 0x522a76 in FT_Stream_ReadAt src/base/ftstream.c:145:7
#1 0x522a76 in FT_Stream_Read src/base/ftstream.c:114
#2 0x62071d in load_format_25 src/sfnt/ttpost.c:336:10
#3 0x62071d in load_post_names src/sfnt/ttpost.c:406
#4 0x6128ca in tt_face_get_ps_name src/sfnt/ttpost.c:547:17
#5 0x623f46 in sfnt_get_glyph_name src/sfnt/sfdriver.c:166:13
#6 0x512123 in FT_Get_Glyph_Name src/base/ftobjs.c:3742:15
#7 0x53b8cc in tt_check_single_notdef src/truetype/ttobjs.c:472:17
#8 0x53b8cc in tt_face_init src/truetype/ttobjs.c:596
#9 0x502650 in open_face src/base/ftobjs.c:1177:15
#10 0x500126 in FT_Open_Face src/base/ftobjs.c:2192:19
#11 0x501ff5 in FT_New_Memory_Face src/base/ftobjs.c:1267:12
#12 0x4ed710 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:149:14
#13 0x4ee5dd in main src/tools/ftfuzzer/ftfuzzer.cc:241:9
#14 0x7f03a385482f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
#15 0x418fb8 in _start (ftfuzzer+0x418fb8)

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #38774:  test_case.ttf added by twsmith (25KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by twsmith (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 22 Oct 2016 04:36:45 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.7.1
    Thu 20 Oct 2016 04:42:17 PM UTCtwsmithAttached File-=>Added test_case.ttf, #38774

    Back to the top


    Powered by Savane 3.1-cleanup1