Sanitizer fixes #9239
Merged
Sanitizer fixes #9239
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Resizing the glyph vector simply drops the pointers, but does not free them. The clear() method does all of this work as well as resetting the pen location.
This fixes some possible heap buffer overflows, such as the following
triggered by our cmmi10.ttf:
```
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000235709 at pc 0x7f95efd3c48a bp 0x7ffe41b6ecc0 sp 0x7ffe41b6ecb0
READ of size 1 at 0x617000235709 thread T0
#0 0x7f95efd3c489 in utf16be_to_ascii extern/ttconv/pprdrv_tt.cpp:178
#1 0x7f95efd3c489 in Read_name(TTFONT*) extern/ttconv/pprdrv_tt.cpp:339
#2 0x7f95efd499ef in read_font(...) extern/ttconv/pprdrv_tt.cpp:1325
#3 0x7f95efd4c602 in get_pdf_charprocs(...) extern/ttconv/pprdrv_tt.cpp:1420
#4 0x7f95efd35c22 in py_get_pdf_charprocs src/_ttconv.cpp:217
0x617000235709 is located 1 bytes to the right of 648-byte region [0x617000235480,0x617000235708)
allocated by thread T0 here:
#0 0x7f9612262a38 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xdea38)
#1 0x7f95efd3b261 in GetTable(TTFONT*, char const*) extern/ttconv/pprdrv_tt.cpp:140
```
|
This is what is coming back from the wget for freetype: |
anntzer
reviewed
Sep 27, 2017
| glyphs.resize(0); | ||
| pen.x = 0; | ||
| pen.y = 0; | ||
| clear(); |
There was a problem hiding this comment.
Note for the future reviewer: this additionally calls FT_Done_Glyph on each element of glyph.
This parts looks good to me.
anntzer
reviewed
Sep 27, 2017
| @@ -137,7 +137,7 @@ BYTE *GetTable(struct TTFONT *font, const char *name) | |||
|
|
|||
| offset = getULONG( ptr + 8 ); | |||
| length = getULONG( ptr + 12 ); | |||
| table = (BYTE*)calloc( sizeof(BYTE), length ); | |||
| table = (BYTE*)calloc( sizeof(BYTE), length + 2 ); | |||
There was a problem hiding this comment.
This looks a bit tricky to review, can you provide a pointer (hehe) to where you expect table to be null-terminated?
There was a problem hiding this comment.
Well, there's only one more diff chunk in this file. ;)
There was a problem hiding this comment.
I know, but what I mean is that it's not clear from the codeflow how the return value of GetTable is later used with the expectation that it is null-terminated. (I am not asking you to unwrap the whole codeflow, just some hint that this is correct...)
There was a problem hiding this comment.
Ah, you mean where the code expects NUL-termination? See the backtrace in the commit:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000235709 at pc 0x7f95efd3c48a bp 0x7ffe41b6ecc0 sp 0x7ffe41b6ecb0
READ of size 1 at 0x617000235709 thread T0
#0 0x7f95efd3c489 in utf16be_to_ascii extern/ttconv/pprdrv_tt.cpp:178
#1 0x7f95efd3c489 in Read_name(TTFONT*) extern/ttconv/pprdrv_tt.cpp:339
#2 0x7f95efd499ef in read_font(...) extern/ttconv/pprdrv_tt.cpp:1325
#3 0x7f95efd4c602 in get_pdf_charprocs(...) extern/ttconv/pprdrv_tt.cpp:1420
#4 0x7f95efd35c22 in py_get_pdf_charprocs src/_ttconv.cpp:217
0x617000235709 is located 1 bytes to the right of 648-byte region [0x617000235480,0x617000235708)
allocated by thread T0 here:
#0 0x7f9612262a38 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xdea38)
#1 0x7f95efd3b261 in GetTable(TTFONT*, char const*) extern/ttconv/pprdrv_tt.cpp:140
Read_name calls utf16be_to_ascii with some pointer in the middle of the table + a length, but it also checks for NUL-termination to ensure no overflows.
There was a problem hiding this comment.
Ah, I see, should have read the commit message :-) Thanks!
anntzer
approved these changes
Sep 28, 2017
dopplershift
approved these changes
Sep 28, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Summary
I ran the tests through ASan, LSan, and UBSan; most tests pass without issue. This PR fixes a leak and a heap buffer read overflow.
There is also a
memcpy(NULL,in the FreeType version we bundle, which may or may not be the cause of #9176 as noted in #9229. Unfortunately, it's a bit more difficult to fix as it has to do with the bundled code, so it's not done here..PR Checklist