The FreeType Project - Bugs: bug #46221, heap-buffer-overflow in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46221: heap-buffer-overflow in t1_decoder_parse_charstrings src/psaux/t1decode.c:455
Submitter: | Kostya Serebryany <kcc> | ||
Submitted: | Fri 16 Oct 2015 05:43:09 AM UTC | ||
Severity: | 3 - Normal | Item Group: | None |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.6.2 |
Jump to the original submission
Mon 19 Oct 2015 09:29:31 PM UTC, comment #9: |
Werner LEMBERG <wl> |
Mon 19 Oct 2015 08:13:17 PM UTC, comment #8: I've locally patched cid_load_glyph with
|
bungeman <bungeman> |
Mon 19 Oct 2015 07:44:15 PM UTC, comment #7: Oh, now I see that
|
bungeman <bungeman> |
Mon 19 Oct 2015 07:38:58 PM UTC, comment #6: I've now also run into this. I've built with asan and set a breakpoint in gdb with 'break __asan_report_error', which allows one to break instead of exiting when asan reports an error. It appears that in t1_decoder_parse_charstrings 'charstring_len' is a very large number (seems to be a negative that is being treated as unsigned) resulting in 'limit' being bogus.
|
bungeman <bungeman> |
Mon 19 Oct 2015 05:35:13 PM UTC, comment #5: ouch, sorry. Same bug, wrong reproducer.
|
Kostya Serebryany <kcc> |
Mon 19 Oct 2015 03:31:15 AM UTC, comment #4: Thanks, but is this really a trace of file #35208 (`crash-846ba5609a2246887b3fb26e8d40128b97d629b0') using the current version of the ftfuzzer program, together with a current version of the library? I get completely different values and tracing messages:
|
Werner LEMBERG <wl> |
Sun 18 Oct 2015 12:05:26 AM UTC, comment #3: (running debug build under valgrind)
|
Kostya Serebryany <kcc> |
Sat 17 Oct 2015 06:23:34 AM UTC, comment #2: The problem with line 522 is now fixed in git, thanks.
|
Werner LEMBERG <wl> |
Fri 16 Oct 2015 05:46:14 AM UTC, comment #1: Maybe a variation of this one, maybe something else;
|
Kostya Serebryany <kcc> |
Fri 16 Oct 2015 05:43:09 AM UTC, original submission:
found by libFuzzer+AddressSanitizer, repro attached.
|
Kostya Serebryany <kcc> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-10-19 | wl | Status | Need Info | Fixed | |
Open/Closed | Open | Closed | |||
Planned Release | None | 2.6.2 | |||
2015-10-17 | wl | Status | None | Need Info | |
Assigned to | None | wl | |||
2015-10-16 | kcc | Attached File | - | Added crash-027a18456050aa0457b45f4f1fcf53bf600eb845, #35209 | |
2015-10-16 | kcc | Attached File | - | Added crash-846ba5609a2246887b3fb26e8d40128b97d629b0, #35208 |
Powered by Savane 3.13-caa5.
Corresponding source code
Thanks to both of you for your assistance! I've applied the patch to the git repository (with minor improvements).