bugThe FreeType Project - Bugs: bug #46220, NULL deref in psh_globals_new...


You are not allowed to post comments on this tracker with your current authentication level.

bug #46220: NULL deref in psh_globals_new src/pshinter/pshglob.c:664:42

Submitter:  Kostya Serebryany <kcc>
Submitted:  Fri 16 Oct 2015 05:38:24 AM UTC
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Sat 17 Oct 2015 04:23:54 AM UTC, comment #1: 

Fixed in git, thanks.  Interestingly, #0 in the AddressSanitizer trace shows a wrong line number; it should rather be 667.

Werner LEMBERG <wl>
Group administrator
Fri 16 Oct 2015 05:38:24 AM UTC, original submission:  

found by libFuzzer, repro attached.

==39391==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000080 (pc 0x00000071f12b bp 0x7ffe41757bb0 sp 0x7ffe41757aa0 T0)
    #0 0x71f12a in psh_globals_new src/pshinter/pshglob.c:664:42
    #1 0x60ee3e in cid_size_init src/cid/cidobjs.c:146:15
    #2 0x4f67b8 in FT_New_Size src/base/ftobjs.c:2504:15
    #3 0x4eeed3 in FT_Open_Face src/base/ftobjs.c:2269:17
    #4 0x4f11fc in FT_New_Memory_Face src/base/ftobjs.c:1267:12
    #5 0x4d71df in LLVMFuzzerTestOneInput

Kostya Serebryany <kcc>
Group Member


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35207:  crash-350d28d466d045d5e873d3256783913be6c35ecc added by kcc (2KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-17 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-16 kcc Attached File- Added crash-350d28d466d045d5e873d3256783913be6c35ecc, #35207

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code