bugThe FreeType Project - Bugs: bug #49858, heap-buffer-overflow in...

 
 

bug #49858: heap-buffer-overflow in cff_parser_run()

Submitted by:  Tyson Smith <twsmith>
Submitted on:  Fri 16 Dec 2016 03:44:26 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.7.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 16 Dec 2016 07:52:51 AM UTC, comment #1:

Fixed in git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 16 Dec 2016 03:44:26 AM UTC, original submission:

Found while fuzzing with FTFuzzer with ASan build.
Commit 01658be6fbda2ff17616158ae5df5dc240a4347c

==4440==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000009300 at pc 0x0000005df312 bp 0x7fff98c6eb30 sp 0x7fff98c6eb28
WRITE of size 8 at 0x617000009300 thread T0
#0 0x5df311 in cff_parser_run src/cff/cffparse.c:1430:22
#1 0x5fe7d6 in cff_subfont_load src/cff/cffload.c:1986:15
#2 0x59319b in cff_font_load src/cff/cffload.c:2202:13
#3 0x59319b in cff_face_init src/cff/cffobjs.c:593
#4 0x502640 in open_face src/base/ftobjs.c:1180:15
#5 0x500116 in FT_Open_Face src/base/ftobjs.c:2195:19
#6 0x501fe5 in FT_New_Memory_Face src/base/ftobjs.c:1270:12
#7 0x4ed6f0 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:149:14
#8 0x4ee5bd in main src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:241:9
#9 0x7f17d0af482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#10 0x418f98 in _start (/home/ubuntu/build/build/ftfuzzer+0x418f98)

0x617000009300 is located 0 bytes to the right of 768-byte region [0x617000009000,0x617000009300)
allocated by thread T0 here:
#0 0x4b90c8 in __interceptor_malloc (/home/ubuntu/build/build/ftfuzzer+0x4b90c8)
#1 0x52d607 in ft_mem_qalloc src/base/ftutil.c:76:15
#2 0x52d607 in ft_mem_alloc src/base/ftutil.c:55
#3 0x52d607 in ft_mem_qrealloc src/base/ftutil.c:146
#4 0x5fe27c in cff_parser_init src/cff/cffparse.c:65:10
#5 0x5fe27c in cff_subfont_load src/cff/cffload.c:1931
#6 0x59319b in cff_font_load src/cff/cffload.c:2202:13
#7 0x59319b in cff_face_init src/cff/cffobjs.c:593
#8 0x502640 in open_face src/base/ftobjs.c:1180:15

SUMMARY: AddressSanitizer: heap-buffer-overflow src/cff/cffparse.c:1430:22 in cff_parser_run
Shadow bytes around the buggy address:
0x0c2e7fff9210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2e7fff9220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2e7fff9230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2e7fff9240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2e7fff9250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fff9260:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e7fff9270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e7fff9280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e7fff9290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e7fff92a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e7fff92b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==4440==ABORTING

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #39246:  test_case.ttf added by twsmith (1014B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by twsmith (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 16 Dec 2016 07:52:51 AM UTCwlStatusNone=>Fixed
      PrivacyPrivate=>Public
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.7.1
    Fri 16 Dec 2016 03:44:26 AM UTCtwsmithAttached File-=>Added test_case.ttf, #39246

    Back to the top


    Powered by Savane 3.1-cleanup1