The FreeType Project - Bugs: bug #35604, Out-of-bounds read in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #35604: Out-of-bounds read in gray_record_cell, resulting in potential memory corruption
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Thu 23 Feb 2012 01:11:43 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | mpsuzuki | Open/Closed: | Closed |
Planned Release: | 2.4.9 |
Jump to the original submission
Thu 22 Mar 2012 04:31:54 PM UTC, comment #14: |
Werner LEMBERG <wl> |
Thu 22 Mar 2012 04:18:48 PM UTC, comment #13: OK, I will check, please let me spend a few weeks to
|
suzuki toshiya <mpsuzuki> |
Thu 22 Mar 2012 03:39:13 PM UTC, comment #12: Mhmm, you are proably right. It has been a long time that I've checked whether FreeType works and compiles on 16bit hosts. I suspect many glitches. Toshiya-san? |
Werner LEMBERG <wl> |
Thu 22 Mar 2012 03:19:52 PM UTC, comment #11: One nitpick: is it expected that the following overflow check is still #if FT_UINT_MAX > 0xFFFFU ?
|
Tomas Hoger <thoger> |
Sun 26 Feb 2012 09:00:37 PM UTC, comment #10: I'm waiting for info from someone at Microsoft to fix #35601 properly. |
Werner LEMBERG <wl> |
Sun 26 Feb 2012 08:38:58 PM UTC, comment #9: Thanks, works fine now. Do you have any plans as of when version 2.4.9 is going to be officially released? |
Mateusz Jurczyk <j00ru> |
Sun 26 Feb 2012 07:56:06 PM UTC, comment #8: Thanks a lot for your detailed analysis. I've applied a patch following your suggestions. Please test. |
Werner LEMBERG <wl> |
Sun 26 Feb 2012 07:21:55 PM UTC, comment #7: I have performed a cursory investigation and I believe I found the bug, as well as the reason it only manifests itself on 64-bit platforms. See below.
|
Mateusz Jurczyk <j00ru> |
Sun 26 Feb 2012 04:37:11 AM UTC, comment #6: Since I don't have access to an amd64 platform, I can't confirm the crash. I'm really dependent on your assistance...
|
Werner LEMBERG <wl> |
Fri 24 Feb 2012 12:59:33 PM UTC, comment #5: I performed several tests, compiled FreeType with the steps outlined by you etc, but the crash still reproduced (see another valgrind log from the crash from current git below).
|
Mateusz Jurczyk <j00ru> |
Fri 24 Feb 2012 11:34:15 AM UTC, comment #4: It's extremely hard to find such a bug if everything's working just fine...
|
Werner LEMBERG <wl> |
Fri 24 Feb 2012 10:11:55 AM UTC, comment #3: Ah, I figured the reason that the crash reproduced in lt-ftbench but not in ftbench was that the former was linked against the latest freetype, and the former against the version present in my OS. It therefore seems the bug must have been introduced recently.
|
Mateusz Jurczyk <j00ru> |
Fri 24 Feb 2012 09:54:02 AM UTC, comment #2: At first, I was testing the public 2.4.8 release. I've just tested both provided sample with the current git of FreeType compiled with ./configure & make with no parameters. Interestingly, the crashes only reproduce with the lt-ftbench binary (bin/.libs/lt-ftbench, created by the /bin/ftbench script), and not with the original ftbench (/bin/.libs/ftbench). |
Mateusz Jurczyk <j00ru> |
Fri 24 Feb 2012 06:02:00 AM UTC, comment #1: Interesting. I can't repeat this on my 32bit i686 GNU/Linux box, using the current git version of FreeType (and valgrind version 3.7.0). Which FreeType version are you testing? May I ask you to retry your test with current git?
|
Werner LEMBERG <wl> |
Thu 23 Feb 2012 01:11:43 PM UTC, original submission:
Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 10 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2012-03-22 | mpsuzuki | Assigned to | wl | mpsuzuki | |
2012-03-22 | wl | Carbon-Copy | - | Added mpsuzuki | |
2012-02-26 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.4.9 | |||
2012-02-25 | wl | Assigned to | None | wl | |
2012-02-23 | j00ru | Attached File | - | Added Umpush.ttf.9f7.205, #25142 | |
2012-02-23 | j00ru | Attached File | - | Added Norasi.dfont.9f7.180, #25141 | |
Carbon-Copy | - | Added j00ru |
Powered by Savane 3.13-bb6a.
Corresponding source code
Thanks. However, this has absolutely no priority!