FreeType sfnt.c Heap Overflow Vulnerability Fix Analysis

Vulnerability Overview This vulnerability involves multiple functions in the file where insufficient overflow checking during memory allocation can lead to a heap overflow. Specific affected functions include , , , , , , , , , , , and . Impact Scope This vulnerability affects all programs that use the file to process font files, particularly those handling untrusted font files. An attacker can trigger a heap overflow by constructing a specific font file, potentially causing the program to crash or execute arbitrary code. Remediation The remediation strategy involves performing overflow checks prior to memory allocation and replacing the original and functions with safer memory allocation functions such as and . Specific modifications include: 1. Adding the function: This function handles scenarios where memory allocation fails. 2. Modifying and functions: Ensuring overflow checks are performed before allocating memory. 3. Updating related functions: In , , , , , , , , , , , and , utilize the new memory allocation functions and incorporate overflow checks. POC Code The following is an example of the remediation code: ```c / Better size overflow checking for sfnt.c. / src/sfnt.c (memory full up) [TEST]: New static function. (xmalloc, xrealloc, krealloc): Use it instead of aborting. (xassert) [TEST]: Remove: no longer needed. (xaddmalloc, xaddrealloc): New static convenience functions. (sfnt_read_cmap_format_12, sfnt_read_cmap_table_short) (sfnt_read_cmap_table_long, sfnt_read_glyf_table) (sfnt_read_simple_glyph, sfnt_read_compound_glyph) (sfnt_read_ttc_header, sfnt_read_glyf_table) (sfnt_read_pred_table, sfnt_create_uvs_context) (sfnt_read_gvar_table, sfnt_read_packed_delta) (sfnt_var_simple_glyph, sfnt_var_compound_glyph): Use the new functions to test for size overflow more reliably. Use a cleaner way to decide whether a pointer addresses the heap not the stack and thus needs freeing. Fix a few more unlikely overflows. (sfnt_read_cmap_format_12): The recently-added early exit is no longer needed, so remove it. (sfnt_read_simple_glyph): Initialize glyph->simple early to simplify later code, as is done in similar functions. Complicate size test to avoid potential unsigned overflow. diff --git a/src/sfnt.c b/src/sfnt.c index 225b372c84b..5c3c248972 100644 --- a/src/sfnt.c +++ b/src/sfnt.c @@ -56,6 +56,12 @@ along with GNU Emacs. If not, see . / #include #include +static void +memory_full_up (void) +{ abort (); +} static void xmalloc (size_t size) { @@ -64,25 +70,40 @@ along with GNU Emacs. If not, see . / ptr = malloc (size); if (!ptr) { memory_full_up (); abort (); } return ptr; } +#if defined HAVE_PROTOTYPES && defined HAVE_PROTOTYPES +static void +xmalloc (size_t n, size_t s) +{ void ptr; ptr = calloc (n, s); if (!ptr) { memory_full_up (); abort (); } return ptr; +} +#endif static void xrealloc (void ptr, size_t size) { void new_ptr; new_ptr = realloc (ptr, size); if (!new_ptr) { memory_full_up (); abort (); } return new_ptr; } @@ -111,3 +132,29 @@ along with GNU Emacs. If not, see . / #define AVOID_Noreturn ATTRIBUTE_COLD void #define xassert(expr) assert (expr) #else +#define TEST_STATIC #include "lisp.h" #endif +static void +xaddmalloc (size_t base, size_t additional) +{ size_t size; size = base + additional; if (ckd_add (&size, additional, base)) memory_full_up (); return xmalloc (size); +} +static void +xaddrealloc (void ptr, size_t base, size_t additional) +{ size_t size; size = base + additional; if (ckd_add (&size, additional, base)) memory_full_up (); return xrealloc (ptr, size); +} #define MIN(a, b) ((a) (b) ? (a) : (b)) @@ -736,8 +775,7 @@ along with GNU Emacs. If not, see . / return NULL; } / Allocate a buffer of sufficient size. / format2 = xmalloc (length + sizeof (format2)); format2 = xaddmalloc (length, sizeof (format2)); format2->format = xmalloc (length + sizeof (format2)); format2->reserved = header->format; format2->length = length; @@ -1594,7 +1637,7 @@ along with GNU Emacs. If not, see . / return NULL; } / Figure out how many glyphs there are based on the length. / loca = xmalloc (sizeof (loca) + directory->length); loca = xaddmalloc (sizeof (loca), directory->length); loca->offsets = (uint32_t ) (loca + 1); loca->num_offsets = directory->length / 4; @@ -1639,7 +1675,7 @@ along with GNU Emacs. If not, see . / return NULL; } / Figure out how many glyphs there are based on the length. / loca = xmalloc (sizeof (loca) + directory->length); loca = xaddmalloc (sizeof (loca), directory->length); loca->offsets = (uint32_t ) (loca + 1); loca->num_offsets = directory->length / 4; @@ -1717,7 +1753,7 @@ along with GNU Emacs. If not, see . / return NULL; } / Allocate enough to hold everything. / glyf = xmalloc (sizeof (glyf) + directory->length); glyf = xaddmalloc (sizeof (glyf), directory->length); glyf->size = directory->length; glyf->glyphs = (unsigned char ) (glyf + 1); @@ -1885,6 +1921,8 @@ along with GNU Emacs. If not, see . / unsigned char vec_start; int16_t delta, x, y; glyph->simple = NULL

Goal Reached Thanks to every supporter — we hit 100%!

FreeType sfnt.c Heap Overflow Vulnerability Fix Analysis