The FreeType Project - Bugs: bug #43656, FreeType 2.5.3 SFNT cmap parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43656: FreeType 2.5.3 SFNT cmap parsing out-of-bounds read in "tt_cmap4_validate"
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Fri 21 Nov 2014 11:30:41 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Sat 22 Nov 2014 05:26:27 AM UTC, comment #1: |
Werner LEMBERG <wl> |
Fri 21 Nov 2014 11:30:41 AM UTC, original submission:
The following heap-based out-of-bounds memory read has been encountered in FreeType, in the handling of the "cmap" (format 4) SFNT table. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 8 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-11-22 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 | |||
2014-11-21 | j00ru | Attached File | - | Added asan_heap-oob_850e0e_4567_cov_3431804032_combustt.ttf, #32499 | |
Attached File | - | Added asan_heap-oob_850e0e_8428_cov_3005715731_mima4x4o.ttf, #32500 | |||
Attached File | - | Added asan_heap-oob_850e0e_7066_cov_1811926313_ilits.ttf, #32501 |
Powered by Savane 3.13-4448.
Corresponding source code
Fixed in git. Thanks for the report!