global buffer overflow in umodenc (parsettf.c)

[fatal0]

# fontforge -lang=ff -c 'Open($1)' ./poc/umodenc-in-parsettf.c-global-buffer-overflow.otf
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 09:14 UTC 13-Jun-2017-D.
 Based on source from git with hash: b8e5ff8f24955f4d7d59ac73c903cc088b21bdb6
Warning: Mac and Windows entries in the 'name' table differ for the
 SubFamily string in the language English (US)
 Mac String: Medium
Windows String: Regular
Warning: Mac and Windows entries in the 'name' table differ for the
 Fullname string in the language English (US)
 Mac String: CFF_Type-1_0x0d_expl Medium
Windows String: CFF_Type-1_0x0d_expl
In CFF_Type-1_0x0d_expl, in glyph .notdef, 'CFF ' advance width (565) and
  'hmtx' width (629) do not match. (Subsequent mismatches will not be reported)
Bad encoding information in 'cmap' table.
=================================================================
==21440==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f0e6b8 at pc 0x0000005367d5 bp 0x7ffc5395e050 sp 0x7ffc5395e040
READ of size 4 at 0x000000f0e6b8 thread T0
    #0 0x5367d4 in umodenc /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:4237
    #1 0x53c51d in readttfencodings /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:4762
    #2 0x546e63 in readttf /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:5563
    #3 0x552652 in _SFReadTTF /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:6266
    #4 0x7e8756 in _ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1114
    #5 0x7ea217 in ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1285
    #6 0x7ea675 in LoadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1343
    #7 0x660df3 in bOpen /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:1854
    #8 0x6b967e in docall /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9352
    #9 0x6b9f99 in handlename /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9463
    #10 0x6be15f in term /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9707
    #11 0x6bf96f in mul /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9852
    #12 0x6bffcf in add /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9897
    #13 0x6c0b1b in comp /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9972
    #14 0x6c1338 in _and /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10015
    #15 0x6c1871 in _or /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10046
    #16 0x6c1e41 in assign /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10078
    #17 0x6c2ff9 in expr /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10156
    #18 0x6c4ab3 in ff_statement /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10365
    #19 0x6c5b4f in ProcessNativeScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10513
    #20 0x6c6536 in _CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10605
    #21 0x6c675b in CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10642
    #22 0x41fa8f in fontforge_main /root/afl_fuzz/project/test/fontforge/fontforgeexe/startnoui.c:113
    #23 0x41f705 in main /root/afl_fuzz/project/test/fontforge/fontforgeexe/main.c:39
    #24 0x7f479ceea82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #25 0x41f618 in _start (/root/afl_fuzz/project/test/fontforge/fontforgeexe/fontforge+0x41f618)

0x000000f0e6b8 is located 24 bytes to the right of global variable 'gb2312_from_unicode_1' defined in 'charset/gb2312.c:1201:29' (0xf0e4a0) of size 512
0x000000f0e6b8 is located 8 bytes to the left of global variable 'gb2312_from_unicode_2' defined in 'charset/gb2312.c:1240:29' (0xf0e6c0) of size 512
SUMMARY: AddressSanitizer: global-buffer-overflow /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:4237 umodenc
Shadow bytes around the buggy address:
  0x0000801d9c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9c90: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000801d9cd0: 00 00 00 00 f9 f9 f9[f9]00 00 00 00 00 00 00 00
  0x0000801d9ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000801d9d10: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  0x0000801d9d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==21440==ABORTING

Testcase:
https://github.com/gnehsoah/poc/blob/master/fontforge/umodenc-in-parsettf.c-global-buffer-overflow.otf

[frank-trampe]

This neither crashes nor generates nasty Valgrind in current master. Are you still able to reproduce it?

[skef]

Closing as not reproducible.