Freetype integer underflow While fuzzing some pdf files a few weeks back, I ended up finding an integer underflow in freetype2. Upstream did commit some fixes, so this issue is somewhat public. 1.ttf will generate this error. Patches: http://cvs.savannah.gnu.org/viewcvs/freetype/freetype2/src/pshinter/pshglob.c?r1=1.30&r2=1.31&makepatch=1&diff_format=h http://cvs.savannah.gnu.org/viewcvs/freetype/freetype2/src/cff/cffload.c?r1=1.73&r2=1.74&makepatch=1&diff_format=h http://cvs.savannah.gnu.org/viewcvs/freetype/freetype2/src/type1/t1load.c?r1=1.104&r2=1.105&makepatch=1&diff_format=h The problem is the number of blue values needs to be even. If a font file claims it's odd, freetype2 doesn't handle it well. The crash is seen in src/pshinter/pshglob.c:psh_blues_set_zones_0() What was basically happening is since read_count is an unsigned integer, and is decremented by 2, it is possible to cause an integer underflow by ensuring the value of read_count is an odd number. Once read_count underflows, the loop starts dumping garbage onto the heap. Normally I wouldn't think this is exploitable as it should crash before anything exciting can happen, most graphical applications are multi-threaded, so this does worry me. At the very least this issue is a denial of service bug. The 2.ttf file in the testcase will also trigger a NULL pointer dereference, which I'm not considering a secuirty issue. The patch is here: http://cvs.savannah.gnu.org/viewcvs/freetype/freetype2/src/base/ftutil.c?r1=1.17&r2=1.18&makepatch=1&diff_format=h This issue also affects RHEL3 This issue also affects RHEL2.1
attachment 125556 [details] contains the testcase
RHEL 3 and RHEL 4 packages are built, will do RHEL 2.1 next week.
RHEL 2.1 packages are built.
Lifting embargo
The NULL pointer dereference has been assigned CVE-2006-2661
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0500.html