The FreeType Project - Bugs: bug #59308, Heap buffer overflow due to...
You are not allowed to post comments on this tracker with your current authentication level.
bug #59308: Heap buffer overflow due to integer truncation in Load_SBit_Png
Submitter: | Sergei Glazunov <glazunov> | ||
Submitted: | Mon 19 Oct 2020 08:25:43 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.10.4 |
( Jump to the original submission )
(Why is this post is considered to be spam? Users may have reported it to be
spam or, if it has been recently posted, it may just be waiting for spamchecks
to be run.) |
-*- <_311721> |
Mon 19 Oct 2020 10:19:13 PM UTC, comment #5: |
bungeman <bungeman> |
Mon 19 Oct 2020 10:16:57 PM UTC, comment #4: I see change https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/ChangeLog?id=a3bab162b2ae616074c8877a04556932998aeacd "[sfnt] Fix heap buffer overflow (#59308)." but it seems to be just a changelog entry and doesn't seem to have the change to pnhshim.c? |
bungeman <bungeman> |
Mon 19 Oct 2020 09:25:59 PM UTC, comment #3: Thank you for the prompt reply! I can confirm that your patch prevents the crash. Just in case, I'm attaching the same font file in a password protected zip archive (pw: infected). |
Sergei Glazunov <glazunov> |
Mon 19 Oct 2020 09:21:33 PM UTC, comment #2: Too bad that the fuzzer run by the Chrome people didn't catch that in the last few years... |
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 09:09:14 PM UTC, comment #1: For some unknown reason I'm not able to download the testcase font; however, here's a patch that should fix the issue – please test!
|
Werner LEMBERG <wl>![]() ![]() |
Mon 19 Oct 2020 08:25:43 PM UTC, original submission:
A heap buffer overflow vulnerability exists due to integer truncation in Load_SBit_Png.
VULNERABILITY DETAILS
[...]
png_get_IHDR( png, info,
[...]
if ( populate_map_and_metrics )
map->width = metrics->width;
[...]
if ( populate_map_and_metrics )
error = ft_glyphslot_alloc_bitmap( slot, size ); // *** 4 ***
[...]
png_read_image( png, rows ); // *** 5 ***
A vulnerability exists in the function `Load_SBit_Png`, which processes PNG images embedded into fonts. This function:
1) Obtains the image width and height from the header as 32-bit integers.
The issue is that libpng uses the original 32-bit values, which are saved in `png_struct`. Therefore, if the original width and/or height are greater than 65535, the allocated buffer won't be able to fit the bitmap.
I've verified that the emergency fix below breaks the proof-of-concept, but a long-term patch will require a more thorough code review:
```
+ /* bail out if the width and/or height were truncated */
REPRODUCTION CASE
=================================================================
0x61d00002ba60 is located 60 bytes to the right of 1956-byte region [0x61d00002b280,0x61d00002ba24)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/user/libpng/.libs/libpng16.so.16+0x9f36e) in png_combine_row
Note that this vulnerability was originally reported to Google Chrome today (2020-10-19) under
This issue has been assigned CVE-2020-15999.
CREDIT INFORMATION
|
Sergei Glazunov <glazunov> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-10-19 | wl | Status | None | ![]() |
Fixed |
Privacy | Private | ![]() |
Public | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.10.4 | ||
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.zip, #50023 |
2020-10-19 | wl | Assigned to | None | ![]() |
wl |
2020-10-19 | glazunov | Attached File | - | ![]() |
Added font.ttf, #50021 |
Attached File | - | ![]() |
Added asan.log, #50022 | ||
Carbon-Copy | - | ![]() |
Added hawkes |
Also, good to know that the suggested change in comment #1 is almost exactly what is being used to patch this in Chromium at the moment (e.g. https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+/refs/heads/chromium/branch-heads/4240%5E%21/#F0 ). (Only difference being the order of imgWidth and imgHeight tests.)