Skip to content

NULL pointer dereference in the SFDGetSpiros() function #4086

Description

@fcambus

Hi,

While fuzzing FontForge with AFL, I found a NULL pointer dereference in the SFDGetSpiros() function, in sfd.c.

Attaching a reproducer (gzipped so GitHub accepts it): test03.sfd.gz

Issue can be reproduced in FontForge 20190801 and with latest Git master by running:

fontforge test03.sfd
=================================================================
==4457==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff8c0d8e2bf bp 0x7fffda0289f0 sp 0x7fffda028930 T0)
==4457==The signal is caused by a READ memory access.
==4457==Hint: address points to the zero page.
    #0 0x7ff8c0d8e2be in SFDGetSpiros /home/fcambus/fontforge-20190801/fontforge/sfd.c:4039
    #1 0x7ff8c0d8e876 in SFDGetSplineSet /home/fcambus/fontforge-20190801/fontforge/sfd.c:4083
    #2 0x7ff8c0d9e9f7 in SFDGetChar /home/fcambus/fontforge-20190801/fontforge/sfd.c:5698
    #3 0x7ff8c0dc0f3d in SFD_GetFont /home/fcambus/fontforge-20190801/fontforge/sfd.c:8984
    #4 0x7ff8c0dc1e0f in SFD_Read /home/fcambus/fontforge-20190801/fontforge/sfd.c:9077
    #5 0x7ff8c0dc2360 in _SFDRead /home/fcambus/fontforge-20190801/fontforge/sfd.c:9110
    #6 0x7ff8c0e1b7bd in _ReadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1178
    #7 0x7ff8c0e1d0bf in ReadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1321
    #8 0x7ff8c0e1d591 in LoadSplineFont /home/fcambus/fontforge-20190801/fontforge/splinefont.c:1379
    #9 0x7ff8c09dbbbc in ViewPostScriptFont /home/fcambus/fontforge-20190801/fontforge/fontviewbase.c:1347
    #10 0x7ff8c282a89e in fontforge_main /home/fcambus/fontforge-20190801/fontforgeexe/startui.c:1392
    #11 0x559d8dc361ec in main /home/fcambus/fontforge-20190801/fontforgeexe/main.c:33
    #12 0x7ff8c1eb61e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
    #13 0x559d8dc3610d in _start (/home/fcambus/fontforge-20190801/fontforgeexe/.libs/fontforge+0x110d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fcambus/fontforge-20190801/fontforge/sfd.c:4039 in SFDGetSpiros
==4457==ABORTING

Metadata

Metadata

Assignees

No one assigned

    Labels

    �unțrușted inꝑüt�This bug was found, probably with a fuzzer, and requires some kind of unlikely untrusted input.

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions