这里你将找到所有用于在Google Chrome和Ftview（Ubuntu）上执行CVE-2020-15999 PoC的资源。
此仓库包含两个文件夹，每个程序一个。
要在本地复现该漏洞，你需要安装一个早于86.0.4240.111版本的Google Chrome。在我的案例中，我使用了85.0.4183.121版本，可以通过以下命令安装。
sudo dpkg -i google-chrome-stable_85.0.4183.121-1_amd64.deb
最后，使用浏览器访问其中一个文件：exploitFontArray.html 或 exploitFontFile.html。将得到如下结果。
注意： 如果你想使用 exploitFontFile.html，你需要先生成 googleFont.ttf。只需使用 python2 执行 array2file.py 文件：python array2file.py。
由于复现FreeType项目Bug #59308 中的PoC过于复杂，我和我的搭档maarlo开发了一个脚本，你可以在Ftview文件夹中找到它，从而看到如何复现该漏洞。
只需运行该脚本，你将看到以下输出。
=================================================================
==69917==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000029260 at pc 0x7fed4b05d86b bp 0x7ffd022395a0 sp 0x7ffd02239590
WRITE of size 4 at 0x61d000029260 thread T0
#0 0x7fed4b05d86a in png_combine_row /home/user1/Documents/Master/DDS/Trabajo9/libpng-1.6.37/pngrutil.c:3580
#1 0x7fed4b020639 in png_read_row /home/user1/Documents/Master/DDS/Trabajo9/libpng-1.6.37/pngread.c:599
#2 0x7fed4b020c2a in png_read_image /home/user1/Documents/Master/DDS/Trabajo9/libpng-1.6.37/pngread.c:753
#3 0x7fed4aeafc61 in Load_SBit_Png /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/pngshim.c:439
#4 0x7fed4aef5330 in tt_face_load_sbix_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/ttsbit.c:1546
#5 0x7fed4aef589b in tt_face_load_sbit_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/ttsbit.c:1628
#6 0x7fed4adda2d2 in load_sbit_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttgload.c:2429
#7 0x7fed4addbc90 in TT_Load_Glyph /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttgload.c:2829
#8 0x7fed4adcaa91 in tt_glyph_load /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttdriver.c:474
#9 0x7fed4ad879dc in FT_Load_Glyph /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/base/ftobjs.c:948
#10 0x55a7f5f860c8 (/usr/bin/ftview+0x60c8)
#11 0x7fed4aa4a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#12 0x55a7f5f87d1d (/usr/bin/ftview+0x7d1d)
0x61d000029260 is located 60 bytes to the right of 1956-byte region [0x61d000028a80,0x61d000029224)
allocated by thread T0 here:
#0 0x7fed4b1c5bc8 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x7fed4ad7b808 in ft_alloc builds/unix/ftsystem.c:102
#2 0x7fed4adaa836 in ft_mem_qalloc /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/base/ftutil.c:75
#3 0x7fed4adaa681 in ft_mem_alloc /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/base/ftutil.c:54
#4 0x7fed4ad8589e in ft_glyphslot_alloc_bitmap /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/base/ftobjs.c:526
#5 0x7fed4aeaf9bf in Load_SBit_Png /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/pngshim.c:425
#6 0x7fed4aef5330 in tt_face_load_sbix_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/ttsbit.c:1546
#7 0x7fed4aef589b in tt_face_load_sbit_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/sfnt/ttsbit.c:1628
#8 0x7fed4adda2d2 in load_sbit_image /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttgload.c:2429
#9 0x7fed4addbc90 in TT_Load_Glyph /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttgload.c:2829
#10 0x7fed4adcaa91 in tt_glyph_load /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/truetype/ttdriver.c:474
#11 0x7fed4ad879dc in FT_Load_Glyph /home/user1/Documents/Master/DDS/Trabajo9/freetype2-VER-2-10-3/src/base/ftobjs.c:948
#12 0x55a7f5f860c8 (/usr/bin/ftview+0x60c8)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user1/Documents/Master/DDS/Trabajo9/libpng-1.6.37/pngrutil.c:3580 in png_combine_row
Shadow bytes around the buggy address:
0x0c3a7fffd1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffd200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffd210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffd220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffd230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a7fffd240: 00 00 00 00 04 fa fa fa fa fa fa fa[fa]fa fa fa
0x0c3a7fffd250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffd260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffd270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffd280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffd290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==69917==ABORTING