bugThe FreeType Project - Bugs: bug #43776, FreeType 2.5.3 Type42 parsing...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43776: FreeType 2.5.3 Type42 parsing invalid free in "t42_parse_sfnts"

Submitter:  Mateusz Jurczyk <j00ru>
Submitted:  Mon 08 Dec 2014 09:21:39 AM UTC
   
 
Severity:  3 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.5.5

Thu 11 Dec 2014 05:50:59 PM UTC, comment #4: 

Thanks.  This was fixed a few hours ago with patches related to Savannah bug #43794.

  812ed34 * src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.
  c9ca6ff * src/base/ftobjs.c (FT_Get_Glyph_Name): Fix off-by-one check.
  b943811 * src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.

Werner LEMBERG <wl>
Group administrator
Wed 10 Dec 2014 10:08:29 AM UTC, comment #3: 

Sure, find the fonts with more sane names reattached.

(file #32635, file #32636, file #32637)

Mateusz Jurczyk <j00ru>
Group Member
Tue 09 Dec 2014 06:00:18 AM UTC, comment #2: 

Mateusz, the funny file names of your attached fonts confuse Savannah, making it impossible to download them.

Please upload again with simplified names.

Werner LEMBERG <wl>
Group administrator
Mon 08 Dec 2014 09:26:02 AM UTC, comment #1: 

Oops, I see FreeType 2.5.4 has been released in the meanwhile. This report of course concerns the latest version (as per using current git head).

Mateusz Jurczyk <j00ru>
Group Member
Mon 08 Dec 2014 09:21:39 AM UTC, original submission:  

The following invalid free() condition has been encountered in FreeType while fuzzing Type42 fonts. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are three POC files which trigger the condition.

=================================================================
==1462==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x61b00001f70c in thread T0
    #0 0x472581 in __interceptor_free (ft2demos-2.5.3/bin/ftbench+0x472581)
    #1 0xafc208 in ft_free freetype2/src/base/ftsystem.c:130
    #2 0x4b0f50 in ft_mem_free freetype2/src/base/ftutil.c:172
    #3 0x536f3f in ft_mem_qrealloc freetype2/src/base/ftutil.c:135
    #4 0x4b1de1 in ft_mem_realloc freetype2/src/base/ftutil.c:102
    #5 0x7dc516 in t42_parse_sfnts freetype2/src/type42/t42parse.c:583
    #6 0x7cfe70 in t42_load_keyword freetype2/src/type42/t42parse.c:1012
    #7 0x7ce6b1 in t42_parse_dict freetype2/src/type42/t42parse.c:1159
    #8 0x7c8b42 in T42_Open_Face freetype2/src/type42/t42objs.c:63
    #9 0x7be5ab in T42_Face_Init freetype2/src/type42/t42objs.c:202
    #10 0x4ccc8e in open_face freetype2/src/base/ftobjs.c:1170
    #11 0x4c849b in FT_Open_Face freetype2/src/base/ftobjs.c:2151
    #12 0x4c66a8 in FT_New_Face freetype2/src/base/ftobjs.c:1233
    #13 0x491c53 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #14 0x48de68 in main ft2demos-2.5.3/src/ftbench.c:924

0x61b00001f70c is located 1420 bytes inside of 1456-byte region [0x61b00001f180,0x61b00001f730)
allocated by thread T0 here:
    #0 0x4727a1 in malloc (ft2demos-2.5.3/bin/ftbench+0x4727a1)
    #1 0xafbcef in ft_alloc freetype2/src/base/ftsystem.c:74
    #2 0x528311 in ft_mem_qalloc freetype2/src/base/ftutil.c:76
    #3 0x4af8bf in ft_mem_alloc freetype2/src/base/ftutil.c:55
    #4 0x7cbc91 in t42_parser_init freetype2/src/type42/t42parse.c:206
    #5 0x7c897a in T42_Open_Face freetype2/src/type42/t42objs.c:56
    #6 0x7be5ab in T42_Face_Init freetype2/src/type42/t42objs.c:202
    #7 0x4ccc8e in open_face freetype2/src/base/ftobjs.c:1170
    #8 0x4c849b in FT_Open_Face freetype2/src/base/ftobjs.c:2151
    #9 0x4c66a8 in FT_New_Face freetype2/src/base/ftobjs.c:1233
    #10 0x491c53 in get_face ft2demos-2.5.3/src/ftbench.c:705
    #11 0x48de68 in main ft2demos-2.5.3/src/ftbench.c:924

SUMMARY: AddressSanitizer: bad-free ??:0 __interceptor_free
==1462==ABORTING

Mateusz Jurczyk <j00ru>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #32635:  1.t42 added by j00ru (2KiB - application/octet-stream)
file #32636:  3.t42 added by j00ru (1KiB - application/octet-stream)
file #32637:  2.t42 added by j00ru (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by j00ru (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 12 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-11 wl StatusNeed Info Fixed
        PrivacyPrivate Public
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.5.5
    2014-12-10 j00ru Attached File- Added 1.t42, #32635
        Attached File- Added 3.t42, #32636
        Attached File- Added 2.t42, #32637
    2014-12-09 wl StatusNone Need Info
        Assigned toNone wl
    2014-12-08 j00ru Attached File- Added id%3A000000,sig%3A06,src%3A011260,op%3Ahavoc,rep%3A16, #32619
        Attached File- Added id%3A000001,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A64, #32620
        Attached File- Added id%3A000000,sig%3A06,src%3A014021,op%3Ahavoc,rep%3A8, #32621

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code