bugThe FreeType Project - Bugs: bug #46107, four instances of signed integer...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46107: four instances of signed integer overflow in src/cff/cf2hints.c

Submitter:  Kostya Serebryany <kcc>
Submitted:  Fri 02 Oct 2015 08:58:34 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.8.1

Jump to the original submission

Thu 01 Jun 2017 04:30:36 PM UTC, comment #10: 

I think I've fixed all of those overflows in git.  Now waiting for the fuzzer to report more :-)

Werner LEMBERG <wl>
Group administrator
Wed 21 Oct 2015 12:00:33 PM UTC, comment #9: 

Dave provided a patch for the assertion issue, now applied to the git repository.

Werner LEMBERG <wl>
Group administrator
Mon 19 Oct 2015 04:58:42 AM UTC, comment #8: 

I plan to follow the advice given in https://savannah.nongnu.org/bugs/?46149#comment8 to resolve this issue (together with same macro voodoo in case this functionality is missing in the compiler).  It's certainly a good idea to mark the places where overflow can happen without any harm.

In other words, no action is currently necessary for the overflow stuff.  There's no pressure, and as soon as the infrastructure is implemented, it should be straightforward to convert the affected operations.

Werner LEMBERG <wl>
Group administrator
Thu 15 Oct 2015 11:44:09 PM UTC, comment #7: 

The original CFF hint engine was designed with a goal of small code size. This led to two principles: good fonts should render correctly and bad fonts should not crash. In other words, it is acceptable for a bad font to render badly without necessarily returning an error. The use of 32-bit integers to hold 16.16 fixed point numbers is widespread, and usually not checked because it is not used in computing addresses.

It would be quite a bit of work (and code) to test and avoid all fixed point overflow. What would be gained?

I think the assertion is a separate issue, and should be removed and handled as an error.

Dave Arnold <darnold>
Group Member
Wed 07 Oct 2015 01:24:28 AM UTC, comment #6: 

Note that in debug mode this actually triggers assertions,
i.e. prevents us from fuzzing in debug mode.

cff_index_get_pointers: invalid first offset value 12 set to zero
assertion failed on line 591 of file src/cff/cf2hints.c

Kostya Serebryany <kcc>
Group Member
Sun 04 Oct 2015 06:44:49 AM UTC, comment #5: 

I've tweaked the bot to ignore all ubsan warnings with "/cff/"

>>  all those overflows are harmless,

You know better.
Strictly speaking, any signed int overflow is undefined behavior,
and as such can not be harmless. But yes, there are different
levels of "harmful".

Kostya Serebryany <kcc>
Group Member
Sat 03 Oct 2015 08:16:48 AM UTC, comment #4: 

Thanks.  It will take some time until Dave can take care of it, I guess.  On the other hand, all those overflows are harmless, AFAICS, so there is no pressure here.

Werner LEMBERG <wl>
Group administrator
Sat 03 Oct 2015 02:23:53 AM UTC, comment #3: 

Assigning to David Arnold

Alexei Podtelezhnikov <podtelez>
Group Member
Fri 02 Oct 2015 10:06:26 PM UTC, comment #2: 

More similar reports and more reproducers attached:
src/cff/cf2blues.c:197:56: runtime error: signed integer overflow: 2145648640 - -19070976 cannot be represented in type 'int'
src/cff/cf2intrp.c:694:20: runtime error: signed integer overflow: 1869742080 + 1702100992 cannot be represented in type 'int'
src/cff/cf2intrp.c:310:20: runtime error: signed integer overflow: 1620651313 + 556606753 cannot be represented in type 'int'
src/cff/cf2font.c:401:41: runtime error: signed integer overflow: 2 * 2063925248 cannot be represented in type 'int'


(file #35041, file #35042, file #35043, file #35044)

Kostya Serebryany <kcc>
Group Member
Fri 02 Oct 2015 10:00:56 PM UTC, comment #1: 

BTW, these can be found on the FreeType fuzzer bot:
https://github.com/kcc/libfuzzer-example/wiki/FreeType-Fuzzer-Bot

the bot does not properly report reproducers for ubsan
errors because the ubsan errors are not made fatal
for which I'll need to use -fno-sanitize-recover=signed-integer-overflow,shift. And I can't make them fatal before the existing errors are fix, because otherwise the bot will be useless. :)

Kostya Serebryany <kcc>
Group Member
Fri 02 Oct 2015 08:58:34 PM UTC, original submission:  

found in fresh trunk with libFuzzer+UBSan
on this target function:
https://github.com/kcc/libfuzzer-example/blob/master/freetype-experiment/freetype2_fuzzer.cc

attached 3 reproducers that together lead to 4 reports:

src/cff/cf2hints.c:1476:21: runtime error: signed integer overflow: 2 * 1915551744 cannot be represented in type 'int'
src/cff/cf2hints.c:1501:22: runtime error: signed integer overflow: -2 * -1864433664 cannot be represented in type 'int'
src/cff/cf2hints.c:639:60: runtime error: signed integer overflow: 1986405665 + 1978017057 cannot be represented in type 'int'
src/cff/cf2hints.c:1554:23: runtime error: signed integer overflow: -2 * -1653473280 cannot be represented in type 'int'

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35041:  75f9b7f04aaa0b9cf43f91e71ce8137ac29f2a9d added by kcc (710B - application/octet-stream)
file #35042:  4ad5cd343b880732b4786a9ec72ca47aa7e48637 added by kcc (2KiB - application/octet-stream)
file #35043:  3000354c56c0cab4062dd592e66fe9c01d1f2367 added by kcc (711B - application/octet-stream)
file #35044:  1e36938649bca9d56e29896f24a6ece6d7cd308b added by kcc (1KiB - application/octet-stream)
file #35038:  41eb6739af9e5efd97f2452dead0dce7b0518487 added by kcc (712B - application/octet-stream)
file #35039:  245da64fff1c92fdede5603d5ba2df5ed8283bd8 added by kcc (1KiB - application/octet-stream)
file #35040:  05c34d8f8ee9d4a627a02637595eba5a839c5058 added by kcc (709B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnold (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by podtelez (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 13 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-06-01 wl StatusPostponed Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.8.1
    2015-10-21 wl StatusNone Postponed
        Assigned todarnold wl
    2015-10-03 podtelez Assigned toNone darnold
    2015-10-02 kcc Attached File- Added 75f9b7f04aaa0b9cf43f91e71ce8137ac29f2a9d, #35041
        Attached File- Added 4ad5cd343b880732b4786a9ec72ca47aa7e48637, #35042
        Attached File- Added 3000354c56c0cab4062dd592e66fe9c01d1f2367, #35043
        Attached File- Added 1e36938649bca9d56e29896f24a6ece6d7cd308b, #35044
    2015-10-02 kcc Attached File- Added 41eb6739af9e5efd97f2452dead0dce7b0518487, #35038
        Attached File- Added 245da64fff1c92fdede5603d5ba2df5ed8283bd8, #35039
        Attached File- Added 05c34d8f8ee9d4a627a02637595eba5a839c5058, #35040

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code