bugThe FreeType Project - Bugs: bug #51365, SEGV on unknown address in [@...

 
 

bug #51365: SEGV on unknown address in [@ FT_Stream_GetChar]

Submitted by:  Tyson Smith <twsmith>
Submitted on:  Mon 03 Jul 2017 01:37:04 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.8.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 04 Jul 2017 06:13:38 AM UTC, comment #3:

Got it, thanks! Fixed now in git, please test.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 03 Jul 2017 06:06:25 AM UTC, comment #2:

Fair enough :)

You mentioned harfbuzz, I am building with the following parameters to minimize extra code paths I fuzz else where (hb, zlib, png). Perhaps that is why I am seeing the issue?

./configure --disable-shared --enable-static --without-harfbuzz --without-bzip2 --without-png --without-zlib --host i686-pc-linux-gnu

$ ldd ftfuzzer
linux-gate.so.1 => (0xf77de000)
libm.so.6 => /lib/i386-linux-gnu/libm.so.6 (0xf7762000)
libz.so.1 => /lib/i386-linux-gnu/libz.so.1 (0xf7747000)
libstdc++.so.6 => /usr/lib/i386-linux-gnu/libstdc++.so.6 (0xf75cf000)
libpthread.so.0 => /lib/i386-linux-gnu/libpthread.so.0 (0xf75b2000)
librt.so.1 => /lib/i386-linux-gnu/librt.so.1 (0xf75a9000)
libdl.so.2 => /lib/i386-linux-gnu/libdl.so.2 (0xf75a4000)
libgcc_s.so.1 => /lib/i386-linux-gnu/libgcc_s.so.1 (0xf7587000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf73d0000)
/lib/ld-linux.so.2 (0x565d9000)

Tyson Smith <twsmith>
Mon 03 Jul 2017 05:39:16 AM UTC, comment #1:

Hmm, I could reproduce this temporarily. However, after updating my 32bit libfreetype.so in /usr/local/lib to current git (which is necessary on my 64bit openSuSE box for the system's 32bit version of libharfbuzz even if you do static linking for ftfuzzer), I no longer see it.

Please check with ldd or something similar whether all 32bit versions of libfreetype are up to date. If you confirm this, I will try harder :-)

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 03 Jul 2017 01:37:04 AM UTC, original submission:

Found with git revision abeb28f161bc11be4fcdb8af50ab4b736d34a3e5
This only seems to be reproducible with a 32-bit build

==5131==ERROR: AddressSanitizer: SEGV on unknown address 0x006cd6d5 (pc 0x0819c825 bp 0xf5c00eb0 sp 0xffb77290 T0)
==5131==The signal is caused by a READ memory access.
#0 0x819c824 in FT_Stream_GetChar src/base/ftstream.c:353:25
#1 0x81f3831 in ft_var_readpackedpoints src/truetype/ttgxvar.c:142:9
#2 0x820fd54 in TT_Vary_Apply_Glyph_Deltas src/truetype/ttgxvar.c:3405:23
#3 0x82019e8 in load_truetype_glyph src/truetype/ttgload.c:1607:17
#4 0x81bbfb6 in TT_Load_Glyph src/truetype/ttgload.c:2688:13
#5 0x81bbfb6 in tt_glyph_load src/truetype/ttdriver.c:468
#6 0x8161c67 in FT_Load_Glyph src/base/ftobjs.c:766:15
#7 0x82ef528 in af_loader_load_glyph src/autofit/afloader.c:356:13
#8 0x82ef528 in af_autofitter_load_glyph src/autofit/afmodule.c:561
#9 0x81622c9 in FT_Load_Glyph src/base/ftobjs.c:757:19
#10 0x815ee95 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:397:18
#11 0x815f8cb in main src/tools/ftfuzzer/ftfuzzer.cc:445:9
#12 0xf730d636 in __libc_start_main /build/glibc-KM3i_a/glibc-2.23/csu/../csu/libc-start.c:291
#13 0x8066a31 in _start (ftfuzzer+0x8066a31)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/base/ftstream.c:353:25 in FT_Stream_GetChar

Tyson Smith <twsmith>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41108:  test_case.ttf added by twsmith (427KiB - application/x-font-ttf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by twsmith (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 04 Jul 2017 06:13:38 AM UTCwlStatusNeed Info=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.8.1
    Mon 03 Jul 2017 05:39:16 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Mon 03 Jul 2017 01:37:04 AM UTCtwsmithAttached File-=>Added test_case.ttf, #41108

    Back to the top


    Powered by Savane 3.1-cleanup1