FreeType 2.6.1 – TrueType tt_sbit_decoder_load_bit_aligned Heap Out-of-Bounds Read

Exploit Database
114 阅读

作者： Google Security Research

日期： 2015-11-09
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/38662/

100

101

102

103

104

105

106

107

108

109

110

111

112

Source: https://code.google.com/p/google-security-research/issues/detail?id=614

The following heap-based out-of-bounds memory read has been encountered in FreeType. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:

$ ftbench <file>

Attached are three POC files which trigger the conditions.

---

$ freetype2-demos/bin/ftbench asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b

ftbench results for font `asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b'

-------------------------------------------------------------------------------------

family: (null)

style: (null)

number of seconds for each test: 2.000000

starting glyph index: 0

face size: 10ppem

font preloading into memory: no

load flags: 0x0

render mode: 0

CFF engine set to Adobe

TrueType engine set to version 35

maximum cache size: 1024KiByte

executing tests:

Load=================================================================

==22366==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eb55 at pc 0x00000069e2fc bp 0x7fffc4670610 sp 0x7fffc4670608

READ of size 1 at 0x60200000eb55 thread T0

#0 0x69e2fb in tt_sbit_decoder_load_bit_aligned freetype2/src/sfnt/ttsbit.c:834:19

#1 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15

#2 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12

#3 0x69eee2 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:932:15

#4 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15

#5 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12

#6 0x6893d2 in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1506:19

#7 0x55d265 in load_sbit_image freetype2/src/truetype/ttgload.c:2127:13

#8 0x55bedc in TT_Load_Glyph freetype2/src/truetype/ttgload.c:2487:15

#9 0x5301a2 in tt_glyph_load freetype2/src/truetype/ttdriver.c:396:13

#10 0x4f18ae in FT_Load_Glyph freetype2/src/base/ftobjs.c:742:15

#11 0x4e966e in test_load freetype2-demos/src/ftbench.c:250:13

#12 0x4e9c3f in benchmark freetype2-demos/src/ftbench.c:216:15

#13 0x4e80e9 in main freetype2-demos/src/ftbench.c:1058:9

0x60200000eb55 is located 0 bytes to the right of 5-byte region [0x60200000eb50,0x60200000eb55)

allocated by thread T0 here:

#0 0x4bc4a8 in malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40

#1 0x756740 in ft_alloc freetype2/src/base/ftsystem.c:74:12

#2 0x51b4e7 in ft_mem_qalloc freetype2/src/base/ftutil.c:76:15

#3 0x51abb1 in FT_Stream_EnterFrame freetype2/src/base/ftstream.c:269:12

#4 0x51a800 in FT_Stream_ExtractFrame freetype2/src/base/ftstream.c:200:13

#5 0x69ccab in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1036:10

#6 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12

#7 0x69eee2 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:932:15

#8 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15

#9 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12

#10 0x6893d2 in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1506:19

#11 0x55d265 in load_sbit_image freetype2/src/truetype/ttgload.c:2127:13

#12 0x55bedc in TT_Load_Glyph freetype2/src/truetype/ttgload.c:2487:15

#13 0x5301a2 in tt_glyph_load freetype2/src/truetype/ttdriver.c:396:13

#14 0x4f18ae in FT_Load_Glyph freetype2/src/base/ftobjs.c:742:15

#15 0x4e966e in test_load freetype2-demos/src/ftbench.c:250:13

#16 0x4e9c3f in benchmark freetype2-demos/src/ftbench.c:216:15

#17 0x4e80e9 in main freetype2-demos/src/ftbench.c:1058:9

SUMMARY: AddressSanitizer: heap-buffer-overflow freetype2/src/sfnt/ttsbit.c:834:19 in tt_sbit_decoder_load_bit_aligned

Shadow bytes around the buggy address:

0x0c047fff9d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

0x0c047fff9d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

0x0c047fff9d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

0x0c047fff9d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

0x0c047fff9d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa[05]fa fa fa fd fa

0x0c047fff9d70: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa

0x0c047fff9d80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa

0x0c047fff9d90: fa fa fd fa fa fa 04 fa fa fa 00 fa fa fa fd fa

0x0c047fff9da0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd

0x0c047fff9db0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00

Partially addressable: 01 02 03 04 05 06 07

Heap left redzone: fa

Heap right redzone:fb

Freed heap region: fd

Stack left redzone:f1

Stack mid redzone: f2

Stack right redzone: f3

Stack partial redzone: f4

Stack after return:f5

Stack use after scope: f8

Global redzone:f9

Global init order: f6

Poisoned by user:f7

Container overflow:fc

Array cookie:ac

Intra object redzone:bb

ASan internal: fe

Left alloca redzone: ca

Right alloca redzone:cb

==22366==ABORTING

---

The issue was reported in https://savannah.nongnu.org/bugs/?46379.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38662.zip