Bug 1631847
| Summary: | texlive: omfonts one-byte heap overflow | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tom "spot" Callaway <tcallawa> | |
| Component: | texlive | Assignee: | Tom "spot" Callaway <spotrh> | |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 31 | CC: | arjun, codonell, dj, fweimer, law, mfabian, pfrankli, rth, siddhesh, tcallawa, than | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | i686 | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1651284 (view as bug list) | Environment: | ||
| Last Closed: | 2020-06-16 15:34:46 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1651284 | |||
|
Description
Tom "spot" Callaway
2018-09-21 17:31:55 UTC
xmalloc.c:25 is:
void *new_mem = (void *)malloc(size ? size : 1);
Have you run the program under valgrind? What does valgrind say? Thanks. [root@localhost omegafonts]# valgrind .libs/omfonts -ofm2opl ../../../../texk/web2c/omegafonts/tests/check tests/xcheck ==20225== Memcheck, a memory error detector ==20225== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==20225== Using Valgrind-3.14.0.GIT and LibVEX; rerun with -h for copyright info ==20225== Command: .libs/omfonts -ofm2opl ../../../../texk/web2c/omegafonts/tests/check tests/xcheck ==20225== ==20225== Invalid write of size 1 ==20225== at 0x10CA60: adjust_labels (char_routines.c:695) ==20225== by 0x115CC1: ofm_read_rest (parse_ofm.c:368) ==20225== by 0x115CC1: parse_ofm (parse_ofm.c:99) ==20225== by 0x10A9E0: main (omfonts.c:286) ==20225== Address 0x4b13ecc is 0 bytes after a block of size 12 alloc'd ==20225== at 0x4837717: calloc (vg_replace_malloc.c:752) ==20225== by 0x48555E4: xcalloc (xcalloc.c:25) ==20225== by 0x1137C9: retrieve_ligkern_table (ligkern_routines.c:652) ==20225== by 0x115CB5: ofm_read_rest (parse_ofm.c:367) ==20225== by 0x115CB5: parse_ofm (parse_ofm.c:99) ==20225== by 0x10A9E0: main (omfonts.c:286) ==20225== Bad OFM file: Ligature/kern step 2 skips too far; I made it stop. Bad OFM file: Kern index too large. Width index for character "41 is too large; so I reset it to zero. Height index for character "42 is too large; so I reset it to zero. Depth index for character "43 is too large; so I reset it to zero. Ligature/kern starting index for character "44 is too large; so I removed it. Italic correction index for character "45 is too large; so I reset it to zero. Extensible index for character "46 is too large; so I reset it to zero. ==20225== ==20225== HEAP SUMMARY: ==20225== in use at exit: 437,475 bytes in 979 blocks ==20225== total heap usage: 2,867 allocs, 1,888 frees, 891,280 bytes allocated ==20225== ==20225== LEAK SUMMARY: ==20225== definitely lost: 4,401 bytes in 130 blocks ==20225== indirectly lost: 896 bytes in 45 blocks ==20225== possibly lost: 0 bytes in 0 blocks ==20225== still reachable: 432,178 bytes in 804 blocks ==20225== suppressed: 0 bytes in 0 blocks ==20225== Rerun with --leak-check=full to see details of leaked memory ==20225== ==20225== For counts of detected and suppressed errors, rerun with: -v ==20225== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) (In reply to Tom "spot" Callaway from comment #3) > [root@localhost omegafonts]# valgrind .libs/omfonts -ofm2opl > ../../../../texk/web2c/omegafonts/tests/check tests/xcheck > ==20225== Memcheck, a memory error detector > ==20225== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. > ==20225== Using Valgrind-3.14.0.GIT and LibVEX; rerun with -h for copyright > info > ==20225== Command: .libs/omfonts -ofm2opl > ../../../../texk/web2c/omegafonts/tests/check tests/xcheck > ==20225== > ==20225== Invalid write of size 1 > ==20225== at 0x10CA60: adjust_labels (char_routines.c:695) > ==20225== by 0x115CC1: ofm_read_rest (parse_ofm.c:368) > ==20225== by 0x115CC1: parse_ofm (parse_ofm.c:99) > ==20225== by 0x10A9E0: main (omfonts.c:286) > ==20225== Address 0x4b13ecc is 0 bytes after a block of size 12 alloc'd > ==20225== at 0x4837717: calloc (vg_replace_malloc.c:752) > ==20225== by 0x48555E4: xcalloc (xcalloc.c:25) > ==20225== by 0x1137C9: retrieve_ligkern_table (ligkern_routines.c:652) > ==20225== by 0x115CB5: ofm_read_rest (parse_ofm.c:367) > ==20225== by 0x115CB5: parse_ofm (parse_ofm.c:99) > ==20225== by 0x10A9E0: main (omfonts.c:286) > ==20225== Thanks! This is the kind of heap corruption the new checks in glibc malloc are supposed to catch. It's a latent bug in omfonts. It's only visible on 32-bit architectures because on others, the chunk size is rounded up to a larger value. This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to '31'. This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to 31. This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. This is long fixed upstream and in rawhide. |