The FreeType Project - Bugs: bug #59308, Heap buffer overflow due to...
You are not allowed to post comments on this tracker with your current authentication level.
bug #59308: Heap buffer overflow due to integer truncation in Load_SBit_Png
Submitter: | Sergei Glazunov <glazunov> | ||
Submitted: | Mon 19 Oct 2020 08:25:43 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.10.4 |
Jump to the original submission
Spam posted by _311721 | |
Mon 19 Oct 2020 10:19:13 PM UTC, comment #5: |
bungeman <bungeman> |
Mon 19 Oct 2020 10:16:57 PM UTC, comment #4: I see change https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/ChangeLog?id=a3bab162b2ae616074c8877a04556932998aeacd "[sfnt] Fix heap buffer overflow (#59308)." but it seems to be just a changelog entry and doesn't seem to have the change to pnhshim.c? |
bungeman <bungeman> |
Mon 19 Oct 2020 09:25:59 PM UTC, comment #3: Thank you for the prompt reply! I can confirm that your patch prevents the crash. Just in case, I'm attaching the same font file in a password protected zip archive (pw: infected). |
Sergei Glazunov <glazunov> |
Mon 19 Oct 2020 09:21:33 PM UTC, comment #2: Too bad that the fuzzer run by the Chrome people didn't catch that in the last few years... |
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 09:09:14 PM UTC, comment #1: For some unknown reason I'm not able to download the testcase font; however, here's a patch that should fix the issue – please test!
|
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 08:25:43 PM UTC, original submission:
A heap buffer overflow vulnerability exists due to integer truncation in Load_SBit_Png.
|
Sergei Glazunov <glazunov> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-10-19 | wl | Status | None | ![]() |
Fixed |
Privacy | Private | ![]() |
Public | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.10.4 | ||
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.zip, #50023 |
2020-10-19 | wl | Assigned to | None | ![]() |
wl |
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.ttf, #50021 |
Attached File | - | ![]() |
Added asan.log, #50022 | ||
Carbon-Copy | - | ![]() |
Added hawkes |
Also, good to know that the suggested change in comment #1 is almost exactly what is being used to patch this in Chromium at the moment (e.g. https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+/refs/heads/chromium/branch-heads/4240%5E%21/#F0 ). (Only difference being the order of imgWidth and imgHeight tests.)