bugThe FreeType Project - Bugs: bug #57194, Ubsan warning

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57194: Ubsan warning

Submitter:  None
Submitted:  Fri 08 Nov 2019 07:24:34 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.10.2

Jump to the original submission

Sat 23 Nov 2019 12:05:21 PM UTC, comment #7: 

Thanks!

John Stracke <jstrackeg>
Sat 23 Nov 2019 09:43:33 AM UTC, comment #6: 

Fixed in git now, using your patch with slight modifications.  Thanks!

Werner LEMBERG <wl>
Group administrator
Mon 11 Nov 2019 02:50:45 PM UTC, comment #5: 

Sorry, I wasn't specific enough. I'm not calling FT_GlyphLoader_CreateExtra() directly; I'm calling FT_New_Memory_Face(), and FT_GlyphLoader_CreateExtra() is called via:

 ft_open_face_internal()
 FT_New_GlyphSlot()
 ft_glyphslot_init()
 tt_slot_init().

I'll see if I can reproduce it by running ubsan on something simpler.

John Stracke <jstrackeg>
Sat 09 Nov 2019 02:48:33 AM UTC, comment #4: 

Private interfaces can rightfully expect proper usage without too much foolproof. The reported error has to be demonstrated using public API. That's all.

Alexei Podtelezhnikov <podtelez>
Group Member
Fri 08 Nov 2019 11:02:19 PM UTC, comment #3: 

Regarding comment #2: I think this is a misunderstanding.

John, do you have a demo program (together with a font) that triggers the issue?  Or can you reproduce the problem with one of the FreeType demo programs?

Werner LEMBERG <wl>
Group administrator
Fri 08 Nov 2019 10:40:59 PM UTC, comment #2: 

FT_GlyphLoader_CreateExtra is not public. You are not supposed to be using it.


Alexei Podtelezhnikov <podtelez>
Group Member
Fri 08 Nov 2019 07:28:17 PM UTC, comment #1: 

My apologies; I didn't intend to submit this anonymously. I didn't realize I wasn't logged in any more.

John Stracke <jstrackeg>
Fri 08 Nov 2019 07:24:34 PM UTC, original submission:  

In running ubsan (https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) against an application which uses FreeType, I discovered an instance of undefined behavior. The problem was that it was calling FT_GlyphLoader_CreateExtra(), an initializer for FT_GlyphLoader, which allocates space for loader->base.extra_points based on loader->max_points, from the constructor, at which point max_points was always 0. So CreateExtra would allocate 0 bytes and get NULL back (regardless of the system malloc, since it was going through ft_mem_qrealloc). Then it would add 0 to NULL, which is undefined, so ubsan would log an error.

The workaround is to have FT_GlyphLoader_CreateExtra() do nothing if max_points is 0, and call it again later after max_points is increased. I've attached a patch that does this.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #47823:  ubsan.diff added by None (2KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by jstrackeg (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-11-23 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.2
    2019-11-08 None Attached File- Added ubsan.diff, #47823

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code