bugThe FreeType Project - Bugs: bug #48122, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #48122: heap-buffer-overflow in Mac_Read_sfnt_Resource

Submitter:  Kostya Serebryany <kcc>
Submitted:  Sat 04 Jun 2016 12:06:39 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.4

Sat 04 Jun 2016 04:58:39 AM UTC, comment #1: 

Fixed in git, thanks!

 Werner LEMBERG <wl>
Group administrator
Sat 04 Jun 2016 12:06:39 AM UTC, original submission:  

==30831==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009db0 at pc 0x000000561909 bp 0x7fff0dd94030 sp 0x7fff0dd94028
READ of size 8 at 0x612000009db0 thread T0
    #0 0x561908 in Mac_Read_sfnt_Resource src/base/ftobjs.c:1799:29
    #1 0x561908 in IsMacResource src/base/ftobjs.c:1896
    #2 0x535d98 in load_mac_face src/base/ftobjs.c:2082:15
    #3 0x535d98 in FT_Open_Face src/base/ftobjs.c:2235
    #4 0x5384be in FT_New_Memory_Face src/base/ftobjs.c:1267:12
    #5 0x4e8816 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:211:12

0x612000009db0 is located 16 bytes to the left of 272-byte region [0x612000009dc0,0x612000009ed0)
allocated by thread T0 here:
    #0 0x4b9e1d in __interceptor_malloc /usr/local/google/home/kcc/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x556497 in ft_mem_qalloc src/base/ftutil.c:76:15
    #2 0x556497 in ft_mem_alloc src/base/ftutil.c:55
    #3 0x556497 in ft_mem_qrealloc src/base/ftutil.c:146
    #4 0x556497 in ft_mem_realloc src/base/ftutil.c:102
    #5 0x556497 in FT_Raccess_Get_DataOffsets src/base/ftrfork.c:246
    #6 0x55f54f in IsMacResource src/base/ftobjs.c:1887:13
    #7 0x535d98 in load_mac_face src/base/ftobjs.c:2082:15
    #8 0x535d98 in FT_Open_Face src/base/ftobjs.c:2235
    #9 0x5384be in FT_New_Memory_Face src/base/ftobjs.c:1267:12
    #10 0x4e8816 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/ftfuzzer.cc:211:12

repro attached.
Found by a private libFuzzer bot and originally filed here:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10
(not yet publicly visible)

 Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #37384:  fuzz-3-freetype2_fuzzer added by kcc (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-06-04 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.4
    2016-06-04 kcc Attached File- Added fuzz-3-freetype2_fuzzer, #37384

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code