** Description changed: + [ Impact ] + + * freetype leaks memory when applications converts glyphs to bitmaps + using FT_Glyph_To_Bitmap + + [ Test Plan ] + + * sudo apt-get install libasan8 graphicsmagick fonts-dejavu-core + + * testdir=$(mktemp -d) + + * LD_PRELOAD=libasan.so.8 \ + ASAN_OPTIONS=detect_leaks=1:exitcode=1 \ + gm convert -size 400x100 xc:white \ + -font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf \ + -pointsize 24 \ + -draw "text 10,50 'Hello ASAN 1234567890'" \ + "$testdir/tmp.png" + + * The above command should return with exit code 0 + + [ Where problems could occur ] + + * The change is isolated to FT_Glyph_To_Bitmap, if the patch is + incorrect this could result in incorrect glyph conversions, or if + ownership is transferred incorrectly applications could encounter + invalid memory accesses, double frees and similar. + + [ Other Info ] + + * The patch was taken directly from upstream which included the patch + in the now released version 2.14.3 used in stonking. + + --- + + freetype introduced a memory leak in 85c8efe0 (2026-02-07), included in 2.14.2, fixed in e7d2cc64 (2026-03-09) as a 3 line change. Reported upstream as #1399 and independently by OSS-Fuzz. You can reproduce the error using GraphicsMagick: apt-get install -y --no-install-recommends libasan8 graphicsmagick fonts-dejavu-core LD_PRELOAD=libasan.so.8 ASAN_OPTIONS=detect_leaks=1:exitcode=0 \ gm convert -size 400x100 xc:white \ -font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf \ -pointsize 24 -draw "text 10,50 'Hello ASAN 1234567890'" /tmp/gm.png Expected (fixed): no LeakSanitizer output. Actual (libfreetype6 2.14.2+dfsg-1ubuntu0.1): ================================================================= ==3548==ERROR: LeakSanitizer: detected memory leaks Direct leak of 4100 byte(s) in 19 object(s) allocated from: #0 0x7a1f0830a60f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x7a1f07391657 (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x12657) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #2 0x7a1f073959f4 (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x169f4) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #3 0x7a1f073ff5fb (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x805fb) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #4 0x7a1f0739442a (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x1542a) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #5 0x7a1f073a1009 in FT_Glyph_To_Bitmap (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x22009) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #6 0x7a1f07ee9479 (/lib/libGraphicsMagick-Q16.so.3+0x3a479) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #7 0x7a1f07eec01b in AnnotateImage (/lib/libGraphicsMagick-Q16.so.3+0x3d01b) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #8 0x7a1f07fb4e92 (/lib/libGraphicsMagick-Q16.so.3+0x105e92) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #9 0x7a1f07fab7af in DrawImage (/lib/libGraphicsMagick-Q16.so.3+0xfc7af) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #10 0x7a1f07f1902a in MogrifyImage (/lib/libGraphicsMagick-Q16.so.3+0x6a02a) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #11 0x7a1f07f1d36e in MogrifyImages (/lib/libGraphicsMagick-Q16.so.3+0x6e36e) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #12 0x7a1f07f0ea83 in ConvertImageCommand (/lib/libGraphicsMagick-Q16.so.3+0x5fa83) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #13 0x7a1f07f154c7 in MagickCommand (/lib/libGraphicsMagick-Q16.so.3+0x664c7) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #14 0x7a1f07f2d775 (/lib/libGraphicsMagick-Q16.so.3+0x7e775) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #15 0x7a1f07f2d8c2 in GMCommand (/lib/libGraphicsMagick-Q16.so.3+0x7e8c2) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #16 0x7a1f07cb8600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 240c8909736b31f963346aca80667fd00c551e32) #17 0x7a1f07cb8717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 240c8909736b31f963346aca80667fd00c551e32) #18 0x5b9ef1109094 (/usr/bin/gm+0x1094) (BuildId: 1de1cd53831c52408bcb83abb993b253a6bcc457) SUMMARY: AddressSanitizer: 4100 byte(s) leaked in 19 allocation(s). The fix should not affect the ABI. The patch applies cleanly on top of Ubuntu's full patch series (enable-gxvalid-otvalid, ftoption, no-web- fonts, hide-donations-information, CVE-2026-50811-1, CVE-2026-50811-2) with no fuzz or offset. Links: Upstream bug 1399 - https://gitlab.freedesktop.org/freetype/freetype/-/issues/1399 Fix - https://gitlab.freedesktop.org/freetype/freetype/-/commit/e7d2cc6466d048b54aed94012e3ff3bf57e08c53 diff - https://github.com/freetype/freetype/commit/e7d2cc6466d048b54aed94012e3ff3bf57e08c53.patch OSS-Fuzz - https://issues.oss-fuzz.com/issues/482909897 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: libfreetype6 2.14.2+dfsg-1ubuntu0.1 Uname: Linux 6.18.33.2-microsoft-standard-WSL2 x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CloudBuildName: ubuntu-oci:minimized CloudSerial: 20260811.1 Date: Thu Sep 3 09:14:09 2026 ProcEnviron: PATH=(custom, no user) TERM=xterm SourcePackage: freetype UpgradeStatus: No upgrade log present (probably fresh install)
** Description changed: [ Impact ] - * freetype leaks memory when applications converts glyphs to bitmaps + * freetype leaks memory when applications converts glyphs to bitmaps using FT_Glyph_To_Bitmap [ Test Plan ] - * sudo apt-get install libasan8 graphicsmagick fonts-dejavu-core + * sudo apt-get install libasan8 graphicsmagick fonts-dejavu-core - * testdir=$(mktemp -d) + * testdir=$(mktemp -d) - * LD_PRELOAD=libasan.so.8 \ + * LD_PRELOAD=libasan.so.8 \ ASAN_OPTIONS=detect_leaks=1:exitcode=1 \ gm convert -size 400x100 xc:white \ - -font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf \ - -pointsize 24 \ - -draw "text 10,50 'Hello ASAN 1234567890'" \ - "$testdir/tmp.png" + -font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf \ + -pointsize 24 \ + -draw "text 10,50 'Hello ASAN 1234567890'" \ + "$testdir/tmp.png" - * The above command should return with exit code 0 + * The above command should return with exit code 0 [ Where problems could occur ] - * The change is isolated to FT_Glyph_To_Bitmap, if the patch is + * The change is isolated to FT_Glyph_To_Bitmap, if the patch is incorrect this could result in incorrect glyph conversions, or if ownership is transferred incorrectly applications could encounter invalid memory accesses, double frees and similar. [ Other Info ] - * The patch was taken directly from upstream which included the patch - in the now released version 2.14.3 used in stonking. + * The patch was taken directly from upstream [1] which included the + patch in the now released version 2.14.3 used in stonking. + + [1]: + https://gitlab.freedesktop.org/freetype/freetype/-/commit/e7d2cc6466d048b54aed94012e3ff3bf57e08c53 --- - freetype introduced a memory leak in 85c8efe0 (2026-02-07), included in 2.14.2, fixed in e7d2cc64 (2026-03-09) as a 3 line change. Reported upstream as #1399 and independently by OSS-Fuzz. You can reproduce the error using GraphicsMagick: apt-get install -y --no-install-recommends libasan8 graphicsmagick fonts-dejavu-core LD_PRELOAD=libasan.so.8 ASAN_OPTIONS=detect_leaks=1:exitcode=0 \ gm convert -size 400x100 xc:white \ -font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf \ -pointsize 24 -draw "text 10,50 'Hello ASAN 1234567890'" /tmp/gm.png Expected (fixed): no LeakSanitizer output. Actual (libfreetype6 2.14.2+dfsg-1ubuntu0.1): ================================================================= ==3548==ERROR: LeakSanitizer: detected memory leaks Direct leak of 4100 byte(s) in 19 object(s) allocated from: #0 0x7a1f0830a60f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x7a1f07391657 (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x12657) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #2 0x7a1f073959f4 (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x169f4) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #3 0x7a1f073ff5fb (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x805fb) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #4 0x7a1f0739442a (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x1542a) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #5 0x7a1f073a1009 in FT_Glyph_To_Bitmap (/usr/lib/x86_64-linux-gnu/libfreetype.so.6+0x22009) (BuildId: 06b00383961c2dbc8aaf7d0e70abe39fcc70eb8f) #6 0x7a1f07ee9479 (/lib/libGraphicsMagick-Q16.so.3+0x3a479) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #7 0x7a1f07eec01b in AnnotateImage (/lib/libGraphicsMagick-Q16.so.3+0x3d01b) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #8 0x7a1f07fb4e92 (/lib/libGraphicsMagick-Q16.so.3+0x105e92) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #9 0x7a1f07fab7af in DrawImage (/lib/libGraphicsMagick-Q16.so.3+0xfc7af) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #10 0x7a1f07f1902a in MogrifyImage (/lib/libGraphicsMagick-Q16.so.3+0x6a02a) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #11 0x7a1f07f1d36e in MogrifyImages (/lib/libGraphicsMagick-Q16.so.3+0x6e36e) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #12 0x7a1f07f0ea83 in ConvertImageCommand (/lib/libGraphicsMagick-Q16.so.3+0x5fa83) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #13 0x7a1f07f154c7 in MagickCommand (/lib/libGraphicsMagick-Q16.so.3+0x664c7) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #14 0x7a1f07f2d775 (/lib/libGraphicsMagick-Q16.so.3+0x7e775) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #15 0x7a1f07f2d8c2 in GMCommand (/lib/libGraphicsMagick-Q16.so.3+0x7e8c2) (BuildId: ece43e2887d5d51362c21be6a7299e41992d0d62) #16 0x7a1f07cb8600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 240c8909736b31f963346aca80667fd00c551e32) #17 0x7a1f07cb8717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 240c8909736b31f963346aca80667fd00c551e32) #18 0x5b9ef1109094 (/usr/bin/gm+0x1094) (BuildId: 1de1cd53831c52408bcb83abb993b253a6bcc457) SUMMARY: AddressSanitizer: 4100 byte(s) leaked in 19 allocation(s). The fix should not affect the ABI. The patch applies cleanly on top of Ubuntu's full patch series (enable-gxvalid-otvalid, ftoption, no-web- fonts, hide-donations-information, CVE-2026-50811-1, CVE-2026-50811-2) with no fuzz or offset. Links: Upstream bug 1399 - https://gitlab.freedesktop.org/freetype/freetype/-/issues/1399 Fix - https://gitlab.freedesktop.org/freetype/freetype/-/commit/e7d2cc6466d048b54aed94012e3ff3bf57e08c53 diff - https://github.com/freetype/freetype/commit/e7d2cc6466d048b54aed94012e3ff3bf57e08c53.patch OSS-Fuzz - https://issues.oss-fuzz.com/issues/482909897 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: libfreetype6 2.14.2+dfsg-1ubuntu0.1 Uname: Linux 6.18.33.2-microsoft-standard-WSL2 x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CloudBuildName: ubuntu-oci:minimized CloudSerial: 20260811.1 Date: Thu Sep 3 09:14:09 2026 ProcEnviron: PATH=(custom, no user) TERM=xterm SourcePackage: freetype UpgradeStatus: No upgrade log present (probably fresh install) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166358 Title: Memory leak in libfreetype6 2.14.2 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/freetype/+bug/2166358/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
