bugThe FreeType Project - Bugs: bug #45923, buffer overflow in...

 
 

bug #45923: buffer overflow in T1_Get_Private_Dict while doing FT_New_Memory_Face

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Fri 11 Sep 2015 07:18:44 AM UTC  
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  Werner LEMBERG <wl> Open/Closed:  Closed
Planned Release:  2.6.1

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 13 Sep 2015 06:44:20 AM UTC, comment #1:

Fixed in git, thanks.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 11 Sep 2015 07:18:44 AM UTC, original submission:

found on fresh git with libFuzzer+AddressSanitizer

==13050==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000897d90 at pc 0x00000052c3b0 bp 0x7ffce2ef7c70 sp 0x7ffce2ef7c68
READ of size 1 at 0x000000897d90 thread T0
#0 0x52c3af in T1_Get_Private_Dict src/type1/t1parse.c:345:13
#1 0x52c3af in T1_Open_Face src/type1/t1load.c:2118
#2 0x52c3af in T1_Face_Init src/type1/t1objs.c:339
#3 0x4debc4 in open_face src/base/ftobjs.c:1166:15
#4 0x4dd6ff in FT_Open_Face src/base/ftobjs.c:2152:19
#5 0x4de85c in FT_New_Memory_Face src/base/ftobjs.c:1256:12
#6 0x4d449a in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x4d449a)
#7 0x4d4586 in main (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x4d4586)
#8 0x7fdf300b2ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
#9 0x41c145 in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_asan+0x41c145)

0x000000897d90 is located 0 bytes to the right of global variable 'a' defined in './repro2.c:14:15' (0x897ca0) of size 240

Reproducer code is same as in https://savannah.nongnu.org/bugs/?45922
with this data:

unsigned char a[] = {
0x25, 0x21, 0x46, 0x6f, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x31, 0x2d,
0x31, 0x2e, 0x31, 0x3a, 0x20, 0x48, 0x67, 0x72, 0x73, 0x68, 0x65, 0x79,
0x2d, 0x50, 0x6c, 0x61, 0x69, 0x6e, 0x2d, 0x44, 0x75, 0x70, 0x6c, 0x65,
0x78, 0x2d, 0x49, 0x74, 0x61, 0x32, 0x8b, 0x6c, 0x69, 0x63, 0xd, 0xa,
0x20, 0x64, 0x69, 0x34, 0x31, 0x63, 0x74, 0x20, 0x13, 0x65, 0x67, 0x69,
0x6e, 0xd, 0x9d, 0xa, 0x2f, 0x50, 0x61, 0x69, 0x6e, 0x74, 0x54, 0x79,
0x70, 0x65, 0x20, 0x64, 0xd, 0x30, 0x66, 0xa, 0x20, 0x65, 0x2f, 0x53,
0x74, 0x72, 0xd6, 0x6f, 0x6b, 0x65, 0x57, 0x69, 0x64, 0x74, 0x68, 0x20,
0x36, 0x31, 0x48, 0x64, 0x66, 0xd, 0xa, 0x2f, 0x46, 0x6f, 0x6e, 0x74,
0x54, 0x79, 0x30, 0x20, 0x20, 0x65, 0x70, 0x64, 0x65, 0x66, 0xd, 0xa,
0x2f, 0x46, 0x6f, 0x6e, 0x74, 0x41, 0x6e, 0x66, 0x6f, 0xd, 0xa, 0x38,
0x20, 0x64, 0x69, 0x63, 0x74, 0x20, 0x20, 0x65, 0x70, 0x62, 0x69, 0x64,
0x75, 0x67, 0x6e, 0xd, 0xa, 0x2f, 0xce, 0x6f, 0x74, 0x69, 0x63, 0x65,
0x20, 0x28, 0x41, 0x20, 0x46, 0x72, 0x65, 0x65, 0x78, 0x65, 0x63, 0x20,
0x68, 0x72, 0x29, 0x25, 0x21, 0x46, 0x6f, 0x6e, 0x74, 0x54, 0x79, 0x70,
0x65, 0x31, 0x2d, 0x31, 0x2e, 0x31, 0x28, 0x3a, 0x20, 0x48, 0x67, 0x72,
0x68, 0x65, 0x79, 0x2d, 0x50, 0x6c, 0x61, 0x69, 0x6e, 0x2d, 0x44, 0x75,
0x70, 0x6c, 0x65, 0x78, 0x2d, 0x49, 0x74, 0x61, 0x30, 0x8b, 0x6c, 0x69,
0x61, 0x72, 0x25, 0x21, 0x61, 0x63, 0x74, 0x65, 0x72, 0x25, 0x21, 0x46,
0x20, 0x74, 0x65, 0x65, 0x78, 0x65, 0x63, 0x46, 0x6f, 0x6e, 0x74, 0x54};

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-09-13 wl StatusNone => Fixed
        Assigned toNone => wl
        Open/ClosedOpen => Closed
        Planned ReleaseNone => 2.6.1

    Back to the top


    Powered by Savane 3.4