bugThe FreeType Project - Bugs: bug #56587, Direct-leak (OSS-Fuzz 12809)

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #56587: Direct-leak (OSS-Fuzz 12809)

Submitter:  Dirk Lemstra <dlemstra>
Submitted:  Sun 07 Jul 2019 01:36:29 PM UTC
   
 
Severity:  3 - Normal Item Group:  Incorrect behaviour
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.10.2

Sun 14 Jul 2019 04:34:20 PM UTC, comment #3: 

Generally, `sfwoff.c' is pretty well fuzzed from a coverage perspective, not much we can do here but hope for interesting fuzzing input I'm afraid.

Obviously, we could split the TrueType target to work on WOFF files separately to generate more focussed input ... that could be worth a try?

As for `driver-asan-ubsan-o0-fttrace-ccache' -- Dirk, I understand that `clusterfuzz-testcase-minimized-ping_ttf_fuzzer-5647364126146560' is some blob that contains a WOFF font somewhere deep inside ... if my assumption is correct, is there an easy way to extract the WOFF from the blob?

Thanks
Armin

 Armin <cherusker>
Group Member
Fri 12 Jul 2019 09:37:30 AM UTC, comment #2: 

Should be fixed now in git.  Please test.

 Werner LEMBERG <wl>
Group administrator
Fri 12 Jul 2019 09:06:54 AM UTC, comment #1: 

Thanks for the report.  Armin, could you add woff support to your fuzzing stuff?  It seems that I can't reproduce the leak with `driver-asan-ubsan-o0-fttrace-ccache'.  In case you can, please tell me how to do so.

Werner LEMBERG <wl>
Group administrator
Sun 07 Jul 2019 01:36:29 PM UTC, original submission:  

The ImageMagick project is using https://github.com/google/oss-fuzz to find bugs in our own library and in libraries that we use. The fuzzer found an issue and we think this is an issue that should be resolved in the library that we use. This issue is posted under the url https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12809. Below are the details of the issue that can be reproduced using the following technique: https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md.

Stacktrace:
Direct leak of 80647 byte(s) in 1 object(s) allocated from:
  #0 0x49855d in _interceptor_malloc _asan_rtl:3
  #1 0x129b887 in ft_mem_qalloc /src/freetype2/src/base/ftutil.c:76:15
  #2 0x129b327 in FT_Stream_EnterFrame /src/freetype2/src/base/ftstream.c:272:12
  #3 0x138260d in woff_open_font /src/freetype2/src/sfnt/sfwoff.c:352:12
  #4 0x13808b1 in sfnt_open_font /src/freetype2/src/sfnt/sfobjs.c:379:15
  #5 0x136ee2c in sfnt_init_face /src/freetype2/src/sfnt/sfobjs.c:517:13
  #6 0x12a940b in tt_face_init /src/freetype2/src/truetype/ttobjs.c:636:13
  #7 0x12a038e in open_face /src/freetype2/src/base/ftobjs.c:1403:15
  #8 0x12873f4 in ft_open_face_internal /src/freetype2/src/base/ftobjs.c:2475:19
  #9 0x6268d8 in RenderFreetype imagemagick/MagickCore/annotate.c:1376:13
  #10 0x6241d8 in RenderType imagemagick/MagickCore/annotate.c:0
  #11 0x623bf7 in GetTypeMetrics imagemagick/MagickCore/annotate.c:873:10
  #12 0x6d532b in RenderMVGContent imagemagick/MagickCore/draw.c:4294:17
  #13 0xa5fbb7 in ReadTTFImage imagemagick/coders/ttf.c:289:10
  #14 0x69b9b2 in ReadImage imagemagick/MagickCore/constitute.c:547:15
  #15 0x88decb in ReadStream imagemagick/MagickCore/stream.c:1043:9
  #16 0x642934 in PingBlob imagemagick/MagickCore/blob.c:3607:13
  #17 0x58ab72 in Magick::Image::ping(Magick::Blob const&) imagemagick/Magick++/lib/Image.cpp:3860:12
  #18 0x4ca112 in LLVMFuzzerTestOneInput imagemagick/Magick++/fuzz/ping_fuzzer.cc:43:11
  #19 0x515a70 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:553:15
  #20 0x4cb8ef in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:292:6
  #21 0x4d86d7 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:775:9
  #22 0x4caf47 in main /src/libfuzzer/FuzzerMain.cpp:19:10
  #23 0x7f0587b8f82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291
 
Links:
https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/sfwoff.c?id=05439f5cc69eaa3deaf3db52a7999af09a2c293a#n352
https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/sfwoff.c?id=05439f5cc69eaa3deaf3db52a7999af09a2c293a#n379

Commit: 05439f5cc69eaa3deaf3db52a7999af09a2c293a

A call should be made to FT_FRAME_EXIT() before the goto Exit call at multiple places. And while investigating this issue we also found that same problem here:
https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/winfonts/winfnt.c?id=05439f5cc69eaa3deaf3db52a7999af09a2c293a#n334

 Dirk Lemstra <dlemstra>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #47169:  clusterfuzz-testcase-minimized-ping_ttf_fuzzer-5647364126146560 added by dlemstra (119KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cherusker (Posted a comment)
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by wl
  • -email is unavailable- added by dlemstra (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-07-12 wl StatusNone Fixed
        PrivacyPrivate Public
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.10.2
    2019-07-12 wl Assigned toNone wl
    2019-07-12 wl Carbon-Copy- Added cherusker
    2019-07-07 dlemstra Attached File- Added clusterfuzz-testcase-minimized-ping_ttf_fuzzer-5647364126146560, #47169

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-d582.
    Corresponding source code