bugThe FreeType Project - Bugs: bug #46252, Enormous (144TB, arbitrary)...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46252: Enormous (144TB, arbitrary) allocation in cid_read_subrs.

Submitter:  bungeman <bungeman>
Submitted:  Mon 19 Oct 2015 08:59:42 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Tue 20 Oct 2015 08:36:35 PM UTC, comment #3: 

Fixed differently with commit 3eccc3a3.  Thanks for the report!

 Werner LEMBERG <wl>
Group administrator
Mon 19 Oct 2015 09:38:07 PM UTC, comment #2: 

Note that I'm currently working around this killing the fuzzer workers by replacing the TODO comment below with

stream->size < data_len || stream->size - data_len < stream->pos

There may be tighter bounds.

 bungeman <bungeman>
Mon 19 Oct 2015 09:10:02 PM UTC, comment #1: 

It seems this needs to at least ensure that 'data_len' bytes actually exist in the stream before making the allocation. In other words, something like

       data_len = offsets[num_subrs] - offsets[0];

+      if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
+           /* TODO: check data_len bytes exist to be read */  )
+        goto Fail;
+
       if ( FT_NEW_ARRAY( subr->code, num_subrs + 1 ) ||
                FT_ALLOC( subr->code[0], data_len )   )
         goto Fail;

-      if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
-           FT_STREAM_READ( subr->code[0], data_len )  )
+      if ( FT_STREAM_READ( subr->code[0], data_len ) )
         goto Fail;

I must admit I'm not sure of the FreeType idiomatic way of implementing the TODO here.

 bungeman <bungeman>
Mon 19 Oct 2015 08:59:42 PM UTC, original submission:  

Found with libFuzzer+AddressSanitizer, reproduction attached.

The attached cid font causes FreeType to attempt to allocate ~144TB. The report is:

WARNING: AddressSanitizer failed to allocate 0x837b01000000 bytes
AddressSanitizer CHECK failed: src/llvm_all/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:147 "((0)) != (0)" (0x0, x0)

ft_mem_qalloc  src/freetype2/src/base/ftutil.c:76:15
ft_mem_alloc  src/freetype2/src/base/ftutil.c:55:0
cid_read_subrs  src/freetype2/src/cid/cidload.c:494:16
cid_face_open  src/freetype2/src/cid/cidload.c:714:0
cid_face_init  src/freetype2/src/cid/cidobjs.c:327:0
open_face  src/freetype2/src/base/ftobjs.c:1177:15
FT_Open_Face  src/freetype2/src/base/ftobjs.c:2175:19
FT_New_Memory_Face  src/freetype2/src/base/ftobjs.c:1267:12
LLVMFuzzerTestOneInput

 bungeman <bungeman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35231:  crash-ee28578063fc2167017855b7c5c4606e996b7e02 added by bungeman (3KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by bungeman (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-20 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-19 bungeman Attached File- Added crash-ee28578063fc2167017855b7c5c4606e996b7e02, #35231

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code