bugThe FreeType Project - Bugs: bug #46109, use of uninitialized memory in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46109: use of uninitialized memory in pcf_read_TOC

Submitter:  Kostya Serebryany <kcc>
Submitted:  Sat 03 Oct 2015 08:03:55 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.1

Jump to the original submission

Sun 04 Oct 2015 08:50:03 PM UTC, comment #9: 

OK.

Werner LEMBERG <wl>
Group administrator
Sun 04 Oct 2015 08:33:07 PM UTC, comment #8: 

Let's treat this bug as done then.
Eventually we'll set up a proper msan build with all libs instrumented to avoid false positives.

So far, I don't have any other msan reports on my corpus and target function.

Kostya Serebryany <kcc>
Group Member
Sun 04 Oct 2015 08:14:21 PM UTC, comment #7: 

Thanks for the file.

Indeed, it looks like a false positive for FreeType (since it is exactly the same spot already fixed), and yes, the code path uses functions from -lz (called via the `ftgzip.c' file).

Werner LEMBERG <wl>
Group administrator
Sun 04 Oct 2015 06:58:11 PM UTC, comment #6: 

This one does not trigger with valgrind (the previous two did).
Sometimes msan may have false positives if it does not compile everything, and here we link 4 un-instrumented libs
(-lbz2 -lz -lpng -lharfbuzz).
Does this code path call any code from these libs?

Anyway, the repro attached.

(file #35063)

Kostya Serebryany <kcc>
Group Member
Sun 04 Oct 2015 11:19:28 AM UTC, comment #5: 

Hmm, I can't repeat that with valgrind and the current git...  Can you?

Please directly attach the offending file to this bug report; base64 reports an error message.

Werner LEMBERG <wl>
Group administrator
Sun 04 Oct 2015 06:11:08 AM UTC, comment #4: 

Interesting. The majority of msan reports are gone now,
but I still see at least one very similar to the original report:

==12403==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7fa07dec4db5 in pcf_read_TOC src/pcf/pcfread.c:105:59
    #1 0x7fa07dec4db5 in pcf_load_font src/pcf/pcfread.c:1183
    #2 0x7fa07deb687c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #3 0x7fa07dc1da4d in open_face src/base/ftobjs.c:1166:15
    #4 0x7fa07dc16b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #5 0x7fa07dc1ca0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
...

  Uninitialized value was created by a heap allocation
    #0 0x7fa07db8a392 in malloc
    #1 0x7fa07e15c963 in ft_alloc builds/unix/ftsystem.c:102:12
    #2 0x7fa07dc82e8c in ft_mem_qalloc src/base/ftutil.c:76:15
    #3 0x7fa07e0cdb1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:638:11
    #4 0x7fa07deb5da0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
    #5 0x7fa07dc1da4d in open_face src/base/ftobjs.c:1166:15
    #6 0x7fa07dc16b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #7 0x7fa07dc1ca0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12

H4sICmABvygnAAEAAADLRwEBCgH/CAEovwongAlhACkS6QEBAQH/CAEovwABAAAACwCAAAMAME9T
LwonAf8KAAIAAQABMj32TUQAAAEATmEAbWMAOHBp3QQ7AAAFZAAAA85nYXNw//8AAwAAPcAAAAAI
Z2x5Zp83nncAAAskAAAs/mhlYWTM6j51AAAAvAAAADZoaGVhDg0GF/8IASi/CicACQFNKCkBAAAB
/wgBKL8KJ9oAAAIBAQAKNx4nAAAA9AAAAQA=


Kostya Serebryany <kcc>
Group Member
Sun 04 Oct 2015 05:39:59 AM UTC, comment #3: 

Fixed in git, thanks.

Werner LEMBERG <wl>
Group administrator
Sun 04 Oct 2015 04:56:06 AM UTC, comment #2: 

Cool!
This one is fixed, now I observe a similar one (a few lines later in pcf_read_TOC) on a another reproducer

==12852==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f44125dde01 in pcf_read_TOC src/pcf/pcfread.c:138:14
    #1 0x7f44125dde01 in pcf_load_font src/pcf/pcfread.c:1183
    #2 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #3 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
    #4 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #5 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #6 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
    #7 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
    #8 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #9 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)
   
  Uninitialized value was stored to memory at
    #0 0x7f44123a0d20 in FT_Stream_ReadFields src/base/ftstream.c:843:23
    #1 0x7f44125d7a53 in pcf_read_TOC src/pcf/pcfread.c:116:12
    #2 0x7f44125d7a53 in pcf_load_font src/pcf/pcfread.c:1183
    #3 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #4 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
    #5 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #6 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #7 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
    #8 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
    #9 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #10 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)
   
  Uninitialized value was stored to memory at
    #0 0x7f441229c187 in __msan_memcpy
    #1 0x7f44127eac27 in ft_gzip_file_io src/gzip/ftgzip.c:517:7
    #2 0x7f441239acf0 in FT_Stream_EnterFrame src/base/ftstream.c:273:20
    #3 0x7f44123a12e7 in FT_Stream_ReadFields src/base/ftstream.c:742:17
    #4 0x7f44125d7a53 in pcf_read_TOC src/pcf/pcfread.c:116:12
    #5 0x7f44125d7a53 in pcf_load_font src/pcf/pcfread.c:1183
    #6 0x7f44125cf87c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #7 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
    #8 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #9 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #10 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
    #11 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
    #12 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #13 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)
   
  Uninitialized value was created by a heap allocation
    #0 0x7f44122a3392 in malloc
    #1 0x7f44128758b3 in ft_alloc builds/unix/ftsystem.c:102:12
    #2 0x7f441239be8c in ft_mem_qalloc src/base/ftutil.c:76:15
    #3 0x7f44127e6b1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:632:11
    #4 0x7f44125ceda0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
    #5 0x7f4412336a4d in open_face src/base/ftobjs.c:1166:15
    #6 0x7f441232fb22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #7 0x7f4412335a0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #8 0x7f4412300ae4 in TestOneInput (freetype/repro_msan+0x8dae4)
    #9 0x7f441230204b in main (freetype/repro_msan+0x8f04b)
    #10 0x7f44108c0ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #11 0x7f4412296f6e in _start (freetype/repro_msan+0x23f6e)


H4sIHIpgATW/JicAAADjAAEBCgEZGii/GgAJASczACgpPgEBAQH/CAH/Jwr/swooJyECAAAB/gAB
/wFmY3D9AAAAAQAAAAAAmAAAAAAAOxgAACkAANYAAIABZAACACQwAQACAAAAAP46hRQAAACUJwAA
BAAAAGgKRidSASkAAAIQAAAEIABzCicqJaQtUwEA6AAAAA==

Kostya Serebryany <kcc>
Group Member
Sat 03 Oct 2015 07:13:46 PM UTC, comment #1: 

Thanks for the report. Should be fixed in git, please test.

Werner LEMBERG <wl>
Group administrator
Sat 03 Oct 2015 08:03:55 AM UTC, original submission:  

found with libFuzzer+MemorySanitizer

==11865==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f088d2b7db5 in pcf_read_TOC src/pcf/pcfread.c:105:59
    #1 0x7f088d2b7db5 in pcf_load_font src/pcf/pcfread.c:1183
    #2 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #3 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
    #4 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #5 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #6 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
    #7 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
    #8 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #9 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

  Uninitialized value was stored to memory at
    #0 0x7f088d07ad20 in FT_Stream_ReadFields src/base/ftstream.c:843:23
    #1 0x7f088d2b12b2 in pcf_read_TOC src/pcf/pcfread.c:102:10
    #2 0x7f088d2b12b2 in pcf_load_font src/pcf/pcfread.c:1183
    #3 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #4 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
    #5 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #6 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #7 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
    #8 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
    #9 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #10 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

  Uninitialized value was stored to memory at
    #0 0x7f088cf76187 in __msan_memcpy /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1485:3
    #1 0x7f088d4c4c27 in ft_gzip_file_io src/gzip/ftgzip.c:516:7
    #2 0x7f088d074cf0 in FT_Stream_EnterFrame src/base/ftstream.c:273:20
    #3 0x7f088d07b2e7 in FT_Stream_ReadFields src/base/ftstream.c:742:17
    #4 0x7f088d2b12b2 in pcf_read_TOC src/pcf/pcfread.c:102:10
    #5 0x7f088d2b12b2 in pcf_load_font src/pcf/pcfread.c:1183
    #6 0x7f088d2a987c in PCF_Face_Init src/pcf/pcfdrivr.c:335:15
    #7 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
    #8 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #9 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #10 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
    #11 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
    #12 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #13 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)

  Uninitialized value was created by a heap allocation
    #0 0x7f088cf7d392 in malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1002:3
    #1 0x7f088d54f753 in ft_alloc builds/unix/ftsystem.c:102:12
    #2 0x7f088d075e8c in ft_mem_qalloc src/base/ftutil.c:76:15
    #3 0x7f088d4c0b1b in FT_Stream_OpenGzip src/gzip/ftgzip.c:631:11
    #4 0x7f088d2a8da0 in PCF_Face_Init src/pcf/pcfdrivr.c:289:18
    #5 0x7f088d010a4d in open_face src/base/ftobjs.c:1166:15
    #6 0x7f088d009b22 in FT_Open_Face src/base/ftobjs.c:2164:19
    #7 0x7f088d00fa0d in FT_New_Memory_Face src/base/ftobjs.c:1256:12
    #8 0x7f088cfdaae4 in TestOneInput (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8dae4)
    #9 0x7f088cfdc04b in main (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x8f04b)
    #10 0x7f088b59aec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #11 0x7f088cf70f6e in _start (/usr/local/google/home/kcc/fuzz/freetype/repro_msan+0x23f6e)


Valgrind/memcheck agrees:
==12173== Conditional jump or move depends on uninitialised value(s)
==12173==    at 0x43FDCA: pcf_read_TOC (pcfread.c:105)
==12173==    by 0x43FDCA: pcf_load_font (pcfread.c:1183)
==12173==    by 0x441BCA: PCF_Face_Init (pcfdrivr.c:335)
==12173==    by 0x410C81: open_face (ftobjs.c:1166)
==12173==    by 0x412FF7: FT_Open_Face (ftobjs.c:2164)
==12173==    by 0x413903: FT_New_Memory_Face (ftobjs.c:1256)
==12173==    by 0x4078EA: TestOneInput (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173==    by 0x407B33: main (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173==  Uninitialised value was created by a heap allocation
==12173==    at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==12173==    by 0x40FEF4: ft_mem_qalloc (ftutil.c:76)
==12173==    by 0x464F21: FT_Stream_OpenGzip (ftgzip.c:631)
==12173==    by 0x441BA9: PCF_Face_Init (pcfdrivr.c:289)
==12173==    by 0x410C81: open_face (ftobjs.c:1166)
==12173==    by 0x412FF7: FT_Open_Face (ftobjs.c:2164)
==12173==    by 0x413903: FT_New_Memory_Face (ftobjs.c:1256)
==12173==    by 0x4078EA: TestOneInput (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)
==12173==    by 0x407B33: main (in /usr/local/google/home/kcc/fuzz/freetype/repro_orig)


Reproducer:
H4sICmABKL8oJwBwAAAo5AEBCgH/CAFbvxonrwEhoCoYLAEBAQH8KL8KJwH/CgA7AgEAAf4AAf8B
ZmNwEQAAAAEqAAAAAACYAAAAJx0AKQIAAHEAAAgAAQAhKmQAAgAwAAABAABlACUIASFGb250Knlw
ZTAtMS4w0SAvVFRBNUE5ECVGKlNkAC0AAEE6AAFvYmVGAAA=

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35063:  5518286e03c1377ba9e648a4e46e57f104b013fd added by kcc (197B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-04 wl StatusNeed Info Fixed
    2015-10-04 kcc Attached File- Added 5518286e03c1377ba9e648a4e46e57f104b013fd, #35063
    2015-10-04 wl StatusFixed Need Info
    2015-10-03 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.1

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code