Skip to content

/fontforge

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

heap buffer overflow in readttfcopyrights (parsettf.c) #3093

Closed
Lyleaks opened this issue Jun 14, 2017 · 0 comments
Closed

heap buffer overflow in readttfcopyrights (parsettf.c) #3093

Lyleaks opened this issue Jun 14, 2017 · 0 comments

Comments

@Lyleaks
Copy link

@Lyleaks Lyleaks commented Jun 14, 2017 

# fontforge -lang=ff -c 'Open($1)' ./poc/readttfcopyrights-in-parsettf.c-heap-buffer-overflow.otf 
Copyright (c) 2000-2014 by George Williams. See AUTHORS for Contributors.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 with many parts BSD <http://fontforge.org/license.html>. Please read LICENSE.
 Based on sources from 09:14 UTC 13-Jun-2017-D.
 Based on source from git with hash: b8e5ff8f24955f4d7d59ac73c903cc088b21bdb6
Table 'post' extends beyond end of file and must be ignored.
Warning: Mac and Windows entries in the 'name' table differ for the
 Family string in the language English (US)
 Mac String: CFF_TyQe-1_0x0d_expl
Windows String: CFF_Type-1_0x0d_expl
Warning: Mac and Windows entries in the 'name' table differ for the
 SubFamily string in the language English (US)
 Mac String: Medium
Windows String: Regular
Warning: Mac and Windows entries in the 'name' table differ for the
 Fullname string in the language English (US)
 Mac String: CFF_Type-1_0x0d_expl Medium
Windows String: CFF_Type-1_0x0d_expl
Warning: Mac and Windows entries in the 'name' table differ for the
 PostScriptName string in the language English (US)
 Mac String: CFF_TyQe-1_0x0d_expl
Windows String: CFF_Type-1_0x0d_expl
=================================================================
==21383==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dd6f at pc 0x00000051e8d9 bp 0x7fffdda757c0 sp 0x7fffdda757b0
READ of size 1 at 0x60200000dd6f thread T0
    #0 0x51e8d8 in readttfcopyrights /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:1772
    #1 0x51ee2a in readttfpreglyph /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:1804
    #2 0x545d74 in readttf /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:5487
    #3 0x552652 in _SFReadTTF /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:6266
    #4 0x7e8756 in _ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1114
    #5 0x7ea217 in ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1285
    #6 0x7ea675 in LoadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1343
    #7 0x660df3 in bOpen /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:1854
    #8 0x6b967e in docall /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9352
    #9 0x6b9f99 in handlename /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9463
    #10 0x6be15f in term /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9707
    #11 0x6bf96f in mul /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9852
    #12 0x6bffcf in add /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9897
    #13 0x6c0b1b in comp /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9972
    #14 0x6c1338 in _and /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10015
    #15 0x6c1871 in _or /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10046
    #16 0x6c1e41 in assign /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10078
    #17 0x6c2ff9 in expr /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10156
    #18 0x6c4ab3 in ff_statement /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10365
    #19 0x6c5b4f in ProcessNativeScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10513
    #20 0x6c6536 in _CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10605
    #21 0x6c675b in CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10642
    #22 0x41fa8f in fontforge_main /root/afl_fuzz/project/test/fontforge/fontforgeexe/startnoui.c:113
    #23 0x41f705 in main /root/afl_fuzz/project/test/fontforge/fontforgeexe/main.c:39
    #24 0x7f64d797982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #25 0x41f618 in _start (/root/afl_fuzz/project/test/fontforge/fontforgeexe/fontforge+0x41f618)

0x60200000dd6f is located 1 bytes to the left of 1-byte region [0x60200000dd70,0x60200000dd71)
allocated by thread T0 here:
    #0 0x7f64da93130f in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x6230f)
    #1 0xcf5e3d in copy /root/afl_fuzz/project/test/fontforge/Unicode/memory.c:38
    #2 0x51e888 in readttfcopyrights /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:1771
    #3 0x51ee2a in readttfpreglyph /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:1804
    #4 0x545d74 in readttf /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:5487
    #5 0x552652 in _SFReadTTF /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:6266
    #6 0x7e8756 in _ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1114
    #7 0x7ea217 in ReadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1285
    #8 0x7ea675 in LoadSplineFont /root/afl_fuzz/project/test/fontforge/fontforge/splinefont.c:1343
    #9 0x660df3 in bOpen /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:1854
    #10 0x6b967e in docall /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9352
    #11 0x6b9f99 in handlename /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9463
    #12 0x6be15f in term /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9707
    #13 0x6bf96f in mul /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9852
    #14 0x6bffcf in add /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9897
    #15 0x6c0b1b in comp /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:9972
    #16 0x6c1338 in _and /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10015
    #17 0x6c1871 in _or /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10046
    #18 0x6c1e41 in assign /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10078
    #19 0x6c2ff9 in expr /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10156
    #20 0x6c4ab3 in ff_statement /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10365
    #21 0x6c5b4f in ProcessNativeScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10513
    #22 0x6c6536 in _CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10605
    #23 0x6c675b in CheckIsScript /root/afl_fuzz/project/test/fontforge/fontforge/scripting.c:10642
    #24 0x41fa8f in fontforge_main /root/afl_fuzz/project/test/fontforge/fontforgeexe/startnoui.c:113
    #25 0x41f705 in main /root/afl_fuzz/project/test/fontforge/fontforgeexe/main.c:39
    #26 0x7f64d797982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/afl_fuzz/project/test/fontforge/fontforge/parsettf.c:1772 readttfcopyrights
Shadow bytes around the buggy address:
  0x0c047fff9b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]01 fa
  0x0c047fff9bb0: fa fa 00 01 fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9bc0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9bd0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9be0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff9bf0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 06 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==21383==ABORTING

Testcase:
https://github.com/gnehsoah/poc/blob/master/fontforge/readttfcopyrights-in-parsettf.c-heap-buffer-overflow.otf
@copyninja copyninja mentioned this issue Jul 29, 2017
Open
8 of 10 tasks complete
jtanx added a commit that referenced this issue Jul 30, 2017
@jtanx
parsettf.c: Fix out of bounds read condition on buffer
Loading status checks…
e5d9922 
Closes #3093
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@Lyleaks
You can’t perform that action at this time.