The FreeType Project - Bugs: bug #30248, SIGSEGV - write to non-mapped...
You are not allowed to post comments on this tracker with your current authentication level.
bug #30248: SIGSEGV - write to non-mapped memory (looks like it might be exploitable) in base/ftobjs.c:1563
Submitter: | Robert Swiecki <jagger> | ||
Submitted: | Thu 24 Jun 2010 06:41:49 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | mpsuzuki | Open/Closed: | Closed |
Planned Release: | 2.3.13 |
Jump to the original submission
Thu 01 Jul 2010 08:54:18 AM UTC, comment #8: |
suzuki toshiya <mpsuzuki> |
Wed 30 Jun 2010 03:51:33 PM UTC, comment #7: Let's close this one, I've put description of this new issues in the bug #30306 |
Robert Swiecki <jagger> |
Mon 28 Jun 2010 02:48:39 PM UTC, comment #6: I put another font here: http://alt.swiecki.net/j/f/sigabrt24.ttf
|
Robert Swiecki <jagger> |
Fri 25 Jun 2010 02:16:07 PM UTC, comment #5: Looks good to me, thanks. |
Robert Swiecki <jagger> |
Fri 25 Jun 2010 02:03:30 AM UTC, comment #4: Because my patch can prevent visible SEGV (bug #30248)
|
suzuki toshiya <mpsuzuki> |
Fri 25 Jun 2010 12:35:27 AM UTC, comment #3: For first, thank you for reporting the issue.
|
suzuki toshiya <mpsuzuki> |
Thu 24 Jun 2010 08:53:33 PM UTC, comment #2: There's a lot of code which is taking action on the basis of user's input, allocating memory, table indexes. This code must be rewritten, and all user-controlled values must be sanitized. It's definitely exploitable. |
Robert Swiecki <jagger> |
Thu 24 Jun 2010 07:01:05 PM UTC, comment #1: Some more info
|
Robert Swiecki <jagger> |
Thu 24 Jun 2010 06:41:49 PM UTC, original submission:
gcc version 4.4.3, compiled with "-O0 -g"
|
Robert Swiecki <jagger> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2010-07-01 | mpsuzuki | Open/Closed | Open | Closed | |
2010-07-01 | mpsuzuki | Status | In Progress | Fixed | |
Planned Release | None | 2.3.13 | |||
2010-06-25 | mpsuzuki | Status | None | In Progress | |
2010-06-25 | mpsuzuki | Attached File | - | Added fix-mac-read-post-resource_20100625a.patch, #20815 | |
2010-06-24 | wl | Assigned to | None | mpsuzuki | |
2010-06-24 | jagger | Attached File | - | Added sigsegv16.pfb, #20811 |
Powered by Savane 3.13-3230.
Corresponding source code
I added additional buffer size checking
(at present, FreeType2 believes the
total size of PFB declared in header,
allocates the buffer by declared size,
and does not check overrun by putting
too long fragments). I close this issue.