Repository navigation
Sanitizer fixes - #9239
Sanitizer fixes#9239dopplershift merged 2 commits into
Conversation
Sorry, something went wrong.
Resizing the glyph vector simply drops the pointers, but does not free them. The clear() method does all of this work as well as resetting the pen location.
This fixes some possible heap buffer overflows, such as the following
triggered by our cmmi10.ttf:
```
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000235709 at pc 0x7f95efd3c48a bp 0x7ffe41b6ecc0 sp 0x7ffe41b6ecb0
READ of size 1 at 0x617000235709 thread T0
#0 0x7f95efd3c489 in utf16be_to_ascii extern/ttconv/pprdrv_tt.cpp:178
#1 0x7f95efd3c489 in Read_name(TTFONT*) extern/ttconv/pprdrv_tt.cpp:339
#2 0x7f95efd499ef in read_font(...) extern/ttconv/pprdrv_tt.cpp:1325
#3 0x7f95efd4c602 in get_pdf_charprocs(...) extern/ttconv/pprdrv_tt.cpp:1420
#4 0x7f95efd35c22 in py_get_pdf_charprocs src/_ttconv.cpp:217
0x617000235709 is located 1 bytes to the right of 648-byte region [0x617000235480,0x617000235708)
allocated by thread T0 here:
#0 0x7f9612262a38 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xdea38)
#1 0x7f95efd3b261 in GetTable(TTFONT*, char const*) extern/ttconv/pprdrv_tt.cpp:140
```
|
This is what is coming back from the wget for freetype: cat freetype-2.6.1.tar.gz
<html><head>
<title>SourceForge</title>
<!-- <script src="/js/jquery.com/jquery-1.11.0.min.js"></script> -->
<script src="https://code.jquery.com/jquery-1.11.0.min.js"></script>
<script src="https://sourceforge.net/js/mirrors.js"></script>
<script src="/js/sf.js"></script>
<script>
var DR_loc = DR_parse_hash_url();
if (DR_loc) {
DR_sf_main(DR_loc);
} else {
window.location.href = 'https://sourceforge.net/home.html';
}
</script>
</head><body>
<noscript>
We're sorry -- the Sourceforge site is currently in Disaster Recovery mode, and currently requires
the use of javascript to function. Please check back later.
</noscript>
</body></html>
|
Sorry, something went wrong.
| glyphs.resize(0); | ||
| pen.x = 0; | ||
| pen.y = 0; | ||
| clear(); |
There was a problem hiding this comment.
Note for the future reviewer: this additionally calls FT_Done_Glyph on each element of glyph.
This parts looks good to me.
Sorry, something went wrong.
| offset = getULONG( ptr + 8 ); | ||
| length = getULONG( ptr + 12 ); | ||
| table = (BYTE*)calloc( sizeof(BYTE), length ); | ||
| table = (BYTE*)calloc( sizeof(BYTE), length + 2 ); |
There was a problem hiding this comment.
This looks a bit tricky to review, can you provide a pointer (hehe) to where you expect table to be null-terminated?
Sorry, something went wrong.
There was a problem hiding this comment.
Well, there's only one more diff chunk in this file. ;)
Sorry, something went wrong.
There was a problem hiding this comment.
I know, but what I mean is that it's not clear from the codeflow how the return value of GetTable is later used with the expectation that it is null-terminated. (I am not asking you to unwrap the whole codeflow, just some hint that this is correct...)
Sorry, something went wrong.
There was a problem hiding this comment.
Ah, you mean where the code expects NUL-termination? See the backtrace in the commit:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000235709 at pc 0x7f95efd3c48a bp 0x7ffe41b6ecc0 sp 0x7ffe41b6ecb0
READ of size 1 at 0x617000235709 thread T0
#0 0x7f95efd3c489 in utf16be_to_ascii extern/ttconv/pprdrv_tt.cpp:178
#1 0x7f95efd3c489 in Read_name(TTFONT*) extern/ttconv/pprdrv_tt.cpp:339
#2 0x7f95efd499ef in read_font(...) extern/ttconv/pprdrv_tt.cpp:1325
#3 0x7f95efd4c602 in get_pdf_charprocs(...) extern/ttconv/pprdrv_tt.cpp:1420
#4 0x7f95efd35c22 in py_get_pdf_charprocs src/_ttconv.cpp:217
0x617000235709 is located 1 bytes to the right of 648-byte region [0x617000235480,0x617000235708)
allocated by thread T0 here:
#0 0x7f9612262a38 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xdea38)
#1 0x7f95efd3b261 in GetTable(TTFONT*, char const*) extern/ttconv/pprdrv_tt.cpp:140
Read_name calls utf16be_to_ascii with some pointer in the middle of the table + a length, but it also checks for NUL-termination to ensure no overflows.
Sorry, something went wrong.
There was a problem hiding this comment.
Ah, I see, should have read the commit message :-) Thanks!
Sorry, something went wrong.
PR Summary
I ran the tests through ASan, LSan, and UBSan; most tests pass without issue. This PR fixes a leak and a heap buffer read overflow.
There is also a memcpy(NULL, in the FreeType version we bundle, which may or may not be the cause of #9176 as noted in #9229. Unfortunately, it's a bit more difficult to fix as it has to do with the bundled code, so it's not done here..
PR Checklist