bugThe FreeType Project - Bugs: bug #46732, leak in FT_Open_Face

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46732: leak in FT_Open_Face

Submitter:  Kostya Serebryany <kcc>
Submitted:  Mon 21 Dec 2015 03:59:57 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.3

Mon 21 Dec 2015 07:48:01 PM UTC, comment #3: 

Confirmed, the bot is happy now, thanks!

Kostya Serebryany <kcc>
Group Member
Mon 21 Dec 2015 04:27:55 PM UTC, comment #2: 

Fixed now in git.  Thanks for the report!

Werner LEMBERG <wl>
Group administrator
Mon 21 Dec 2015 04:45:53 AM UTC, comment #1: 

This is certainly a recent regression; will check it soon.

Werner LEMBERG <wl>
Group administrator
Mon 21 Dec 2015 03:59:57 AM UTC, original submission:  

Found by libFuzzer bot + AddressSanitizer

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4b618b in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
    #1 0x51c01e in ft_mem_qalloc src/base/ftutil.c:76:15
    #2 0x51c01e in ft_mem_alloc src/base/ftutil.c:55
    #3 0x5de8ff in parse_subrs src/type1/t1load.c:1461:14
    #4 0x5d897b in t1_load_keyword src/type1/t1load.c:952:7
    #5 0x5d897b in parse_dict src/type1/t1load.c:2104
    #6 0x5bf709 in T1_Open_Face src/type1/t1load.c:2206:13
    #7 0x5bf709 in T1_Face_Init src/type1/t1objs.c:342
    #8 0x52d465 in open_face src/base/ftobjs.c:1178:15
    #9 0x529746 in FT_Open_Face src/base/ftobjs.c:2178:19
    #10 0x52cd3c in FT_New_Memory_Face src/base/ftobjs.c:1268:12
    #11 0x4e218f in LLVMFuzzerTestOneInput

Indirect leak of 1928 byte(s) in 1 object(s) allocated from:
    #0 0x4b618b in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
    #1 0x5216c4 in ft_mem_qalloc src/base/ftutil.c:76:15
    #2 0x5216c4 in ft_mem_alloc src/base/ftutil.c:55
    #3 0x5216c4 in ft_mem_qrealloc src/base/ftutil.c:146
    #4 0x5216c4 in ft_mem_realloc src/base/ftutil.c:102
    #5 0x5216c4 in ft_hash_init src/base/fthash.c:188
    #6 0x5deaee in parse_subrs src/type1/t1load.c:1464:17
    #7 0x5d897b in t1_load_keyword src/type1/t1load.c:952:7
    #8 0x5d897b in parse_dict src/type1/t1load.c:2104
    #9 0x5bf709 in T1_Open_Face src/type1/t1load.c:2206:13
    #10 0x5bf709 in T1_Face_Init src/type1/t1objs.c:342
    #11 0x52d465 in open_face src/base/ftobjs.c:1178:15
    #12 0x529746 in FT_Open_Face src/base/ftobjs.c:2178:19
    #13 0x52cd3c in FT_New_Memory_Face

Repro attached.

The bot has started reporting it just recently, but I don't know if this is a
recent regression or the bot has discovered something new after several weeks of silence.
WDYT?

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-12-21 wl StatusNone Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.3
    2015-12-21 wl Assigned toNone wl
    2015-12-21 kcc Attached File- Added CORPORA-C1-9fb7763a8b6dd59a5a1035726621965d78aaa95c, #35808

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code