Hi,
While fuzzing FontForge with AFL, I found a NULL pointer dereference in the strstrmatch() function, in char.c.
Attaching a reproducer (gzipped so GitHub accepts it): test05.sfd.gz
Issue can be reproduced in FontForge 20190801 and with latest Git master by running:
fontforge -lang ff -c 'Open("test05.sfd"); Generate("test05.otf")'
=================================================================
==13449==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe84086f7a5 bp 0x7ffdb2480f00 sp 0x7ffdb2480ed0 T0)
==13449==The signal is caused by a READ memory access.
==13449==Hint: address points to the zero page.
#0 0x7fe84086f7a4 in strstrmatch /home/fcambus/fontforge-20190801/Unicode/char.c:84
#1 0x7fe83ff15681 in SFDefaultOS2Info /home/fcambus/fontforge-20190801/fontforge/tottf.c:3084
#2 0x7fe83ff37756 in initTables /home/fcambus/fontforge-20190801/fontforge/tottf.c:5704
#3 0x7fe83ff3c475 in _WriteTTFFont /home/fcambus/fontforge-20190801/fontforge/tottf.c:6143
#4 0x7fe83ff3c611 in WriteTTFFont /home/fcambus/fontforge-20190801/fontforge/tottf.c:6171
#5 0x7fe83faef0b4 in _DoSave /home/fcambus/fontforge-20190801/fontforge/savefont.c:845
#6 0x7fe83faf1f7b in GenerateScript /home/fcambus/fontforge-20190801/fontforge/savefont.c:1269
#7 0x7fe83fb089c4 in bGenerate /home/fcambus/fontforge-20190801/fontforge/scripting.c:2061
#8 0x7fe83fb666bb in docall /home/fcambus/fontforge-20190801/fontforge/scripting.c:9632
#9 0x7fe83fb6755e in handlename /home/fcambus/fontforge-20190801/fontforge/scripting.c:9745
#10 0x7fe83fb6b8d0 in term /home/fcambus/fontforge-20190801/fontforge/scripting.c:9983
#11 0x7fe83fb6d1de in mul /home/fcambus/fontforge-20190801/fontforge/scripting.c:10128
#12 0x7fe83fb6dade in add /home/fcambus/fontforge-20190801/fontforge/scripting.c:10174
#13 0x7fe83fb6e9e7 in comp /home/fcambus/fontforge-20190801/fontforge/scripting.c:10249
#14 0x7fe83fb6f44d in _and /home/fcambus/fontforge-20190801/fontforge/scripting.c:10293
#15 0x7fe83fb6fa79 in _or /home/fcambus/fontforge-20190801/fontforge/scripting.c:10325
#16 0x7fe83fb70167 in assign /home/fcambus/fontforge-20190801/fontforge/scripting.c:10358
#17 0x7fe83fb7184f in expr /home/fcambus/fontforge-20190801/fontforge/scripting.c:10436
#18 0x7fe83fb734de in ff_statement /home/fcambus/fontforge-20190801/fontforge/scripting.c:10649
#19 0x7fe83fb74b92 in ProcessNativeScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10796
#20 0x7fe83fb7559f in _CheckIsScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10894
#21 0x7fe83fb75881 in CheckIsScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10927
#22 0x7fe8416b2be7 in fontforge_main /home/fcambus/fontforge-20190801/fontforgeexe/startui.c:1099
#23 0x5575eaf031ec in main /home/fcambus/fontforge-20190801/fontforgeexe/main.c:33
#24 0x7fe840d401e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
#25 0x5575eaf0310d in _start (/home/fcambus/fontforge-20190801/fontforgeexe/.libs/fontforge+0x110d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fcambus/fontforge-20190801/Unicode/char.c:84 in strstrmatch
==13449==ABORTING
Hi,
While fuzzing FontForge with AFL, I found a NULL pointer dereference in the strstrmatch() function, in char.c.
Attaching a reproducer (gzipped so GitHub accepts it): test05.sfd.gz
Issue can be reproduced in FontForge 20190801 and with latest Git master by running: