Skip to content

NULL pointer dereference in the strstrmatch() function #4089

Description

@fcambus

Hi,

While fuzzing FontForge with AFL, I found a NULL pointer dereference in the strstrmatch() function, in char.c.

Attaching a reproducer (gzipped so GitHub accepts it): test05.sfd.gz

Issue can be reproduced in FontForge 20190801 and with latest Git master by running:

fontforge -lang ff -c 'Open("test05.sfd"); Generate("test05.otf")'
=================================================================
==13449==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe84086f7a5 bp 0x7ffdb2480f00 sp 0x7ffdb2480ed0 T0)
==13449==The signal is caused by a READ memory access.
==13449==Hint: address points to the zero page.
    #0 0x7fe84086f7a4 in strstrmatch /home/fcambus/fontforge-20190801/Unicode/char.c:84
    #1 0x7fe83ff15681 in SFDefaultOS2Info /home/fcambus/fontforge-20190801/fontforge/tottf.c:3084
    #2 0x7fe83ff37756 in initTables /home/fcambus/fontforge-20190801/fontforge/tottf.c:5704
    #3 0x7fe83ff3c475 in _WriteTTFFont /home/fcambus/fontforge-20190801/fontforge/tottf.c:6143
    #4 0x7fe83ff3c611 in WriteTTFFont /home/fcambus/fontforge-20190801/fontforge/tottf.c:6171
    #5 0x7fe83faef0b4 in _DoSave /home/fcambus/fontforge-20190801/fontforge/savefont.c:845
    #6 0x7fe83faf1f7b in GenerateScript /home/fcambus/fontforge-20190801/fontforge/savefont.c:1269
    #7 0x7fe83fb089c4 in bGenerate /home/fcambus/fontforge-20190801/fontforge/scripting.c:2061
    #8 0x7fe83fb666bb in docall /home/fcambus/fontforge-20190801/fontforge/scripting.c:9632
    #9 0x7fe83fb6755e in handlename /home/fcambus/fontforge-20190801/fontforge/scripting.c:9745
    #10 0x7fe83fb6b8d0 in term /home/fcambus/fontforge-20190801/fontforge/scripting.c:9983
    #11 0x7fe83fb6d1de in mul /home/fcambus/fontforge-20190801/fontforge/scripting.c:10128
    #12 0x7fe83fb6dade in add /home/fcambus/fontforge-20190801/fontforge/scripting.c:10174
    #13 0x7fe83fb6e9e7 in comp /home/fcambus/fontforge-20190801/fontforge/scripting.c:10249
    #14 0x7fe83fb6f44d in _and /home/fcambus/fontforge-20190801/fontforge/scripting.c:10293
    #15 0x7fe83fb6fa79 in _or /home/fcambus/fontforge-20190801/fontforge/scripting.c:10325
    #16 0x7fe83fb70167 in assign /home/fcambus/fontforge-20190801/fontforge/scripting.c:10358
    #17 0x7fe83fb7184f in expr /home/fcambus/fontforge-20190801/fontforge/scripting.c:10436
    #18 0x7fe83fb734de in ff_statement /home/fcambus/fontforge-20190801/fontforge/scripting.c:10649
    #19 0x7fe83fb74b92 in ProcessNativeScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10796
    #20 0x7fe83fb7559f in _CheckIsScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10894
    #21 0x7fe83fb75881 in CheckIsScript /home/fcambus/fontforge-20190801/fontforge/scripting.c:10927
    #22 0x7fe8416b2be7 in fontforge_main /home/fcambus/fontforge-20190801/fontforgeexe/startui.c:1099
    #23 0x5575eaf031ec in main /home/fcambus/fontforge-20190801/fontforgeexe/main.c:33
    #24 0x7fe840d401e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
    #25 0x5575eaf0310d in _start (/home/fcambus/fontforge-20190801/fontforgeexe/.libs/fontforge+0x110d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fcambus/fontforge-20190801/Unicode/char.c:84 in strstrmatch
==13449==ABORTING

Metadata

Metadata

Assignees

No one assigned

    Labels

    �unțrușted inꝑüt�This bug was found, probably with a fuzzer, and requires some kind of unlikely untrusted input.

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions