bugThe FreeType Project - Bugs: bug #49888, null pointer passed as argument...

 
 

bug #49888: null pointer passed as argument declared to never be null in FT_Stream_ReadAt()

Submitted by:  Tyson Smith <twsmith>
Submitted on:  Mon 19 Dec 2016 11:47:26 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.7.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 21 Dec 2016 06:02:05 AM UTC, comment #4:

Note also that I've added a bunch of sanity checks to the Mac font handler; with the current code, your test file gets rejected much earlier (if the BDF is not active).

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Wed 21 Dec 2016 05:58:51 AM UTC, comment #3:

The changes in `modules.cfg' do indeed matter! With the default set of options, FreeType tries the BDF driver, and the test file gets handled indeed as BDF so that Freetype aborts with `invalid BDF' instead of `unknown font format', and the test for mac fonts isn't executed at all.

Fixed now in git. Thanks for the report!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Tue 20 Dec 2016 06:24:51 PM UTC, comment #2:

Sorry I forgot to mention that I built with Clang 3.8.0 and UBSan. I double checked and the test is correct.

I'm not sure if it matters but I also have some changes in modules.cfg to help target only specific areas. I have attached the diff. Let me know if there is a better way of doing this (if it affects reproduction of the test case).

(file #39289)

Tyson Smith <twsmith>
Tue 20 Dec 2016 11:44:46 AM UTC, comment #1:

I can't reproduce this. The attached file doesn't get loaded as a SFNT at all... Is this the right test file?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 19 Dec 2016 11:47:26 PM UTC, original submission:

Found while fuzzing with FTFuzzer with ASan build.
Commit 5743df7718e40c33cb3efa18b2f5fa71e8b59810

base/ftstream.c:145:7: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
#0 0x5333a3 in FT_Stream_ReadAt base/ftstream.c:145:7
#1 0x5333a3 in FT_Stream_Read base/ftstream.c:114
#2 0x5333a3 in Mac_Read_POST_Resource base/ftobjs.c:1743
#3 0x5333a3 in IsMacResource base/ftobjs.c:1889
#4 0x500c75 in load_mac_face base/ftobjs.c:2095:15
#5 0x500c75 in ft_open_face_internal base/ftobjs.c:2279
#6 0x50232b in FT_New_Memory_Face base/ftobjs.c:1279:12
#7 0x4ed53c in LLVMFuzzerTestOneInput tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:120:10
#8 0x4ee5bd in main tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:241:9
#9 0x7ffb7a78382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#10 0x418f98 in _start (/home/ubuntu/build/build/ftfuzzer+0x418f98)

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #39289:  modules.cfg.diff added by twsmith (3KiB - application/octet-stream)
file #39281:  test_case.ttf added by twsmith (172KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by osvdb
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by twsmith (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 21 Dec 2016 05:58:51 AM UTCwlStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.7.1
    Tue 20 Dec 2016 09:13:07 PM UTCosvdbCarbon-Copy-=>Added -unavailable-
    Tue 20 Dec 2016 06:24:51 PM UTCtwsmithAttached File-=>Added modules.cfg.diff, #39289
    Tue 20 Dec 2016 11:44:46 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Mon 19 Dec 2016 11:47:26 PM UTCtwsmithAttached File-=>Added test_case.ttf, #39281

    Back to the top


    Powered by Savane 3.1-cleanup1