The FreeType Project - Bugs: bug #57194, Ubsan warning
You are not allowed to post comments on this tracker with your current authentication level.
bug #57194: Ubsan warning
Submitter: | None | ||
Submitted: | Fri 08 Nov 2019 07:24:34 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Incorrect behaviour |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.10.2 |
Jump to the original submission
Sat 23 Nov 2019 12:05:21 PM UTC, comment #7: |
John Stracke <jstrackeg> |
Sat 23 Nov 2019 09:43:33 AM UTC, comment #6: Fixed in git now, using your patch with slight modifications. Thanks! |
Werner LEMBERG <wl> |
Mon 11 Nov 2019 02:50:45 PM UTC, comment #5: Sorry, I wasn't specific enough. I'm not calling FT_GlyphLoader_CreateExtra() directly; I'm calling FT_New_Memory_Face(), and FT_GlyphLoader_CreateExtra() is called via:
|
John Stracke <jstrackeg> |
Sat 09 Nov 2019 02:48:33 AM UTC, comment #4: Private interfaces can rightfully expect proper usage without too much foolproof. The reported error has to be demonstrated using public API. That's all. |
Alexei Podtelezhnikov <podtelez> |
Fri 08 Nov 2019 11:02:19 PM UTC, comment #3: Regarding comment #2: I think this is a misunderstanding.
|
Werner LEMBERG <wl> |
Fri 08 Nov 2019 10:40:59 PM UTC, comment #2: FT_GlyphLoader_CreateExtra is not public. You are not supposed to be using it.
|
Alexei Podtelezhnikov <podtelez> |
Fri 08 Nov 2019 07:28:17 PM UTC, comment #1: My apologies; I didn't intend to submit this anonymously. I didn't realize I wasn't logged in any more. |
John Stracke <jstrackeg> |
Fri 08 Nov 2019 07:24:34 PM UTC, original submission:
In running ubsan (https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) against an application which uses FreeType, I discovered an instance of undefined behavior. The problem was that it was calling FT_GlyphLoader_CreateExtra(), an initializer for FT_GlyphLoader, which allocates space for loader->base.extra_points based on loader->max_points, from the constructor, at which point max_points was always 0. So CreateExtra would allocate 0 bytes and get NULL back (regardless of the system malloc, since it was going through ft_mem_qrealloc). Then it would add 0 to NULL, which is undefined, so ubsan would log an error.
|
Anonymous |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2019-11-23 | wl | Status | None | Fixed | |
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.10.2 | |||
2019-11-08 | None | Attached File | - | Added ubsan.diff, #47823 |
Powered by Savane 3.13-f8d8.
Corresponding source code
Thanks!