1210485 - MSan: use-of-uninitialized-value in pcf_read_TOC (pcfread.c:105)

Status: RESOLVED INVALID

(Core :: Layout: Text and Fonts, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

This was found while fuzzing freetype 2.5.5

This appears to be a fairly serious issue the the uninitialized values is used as a size in a memory allocation. This can lead to a crash or worse.

This likely also affects Firefox OS since I believe it is used in the aosp kernel.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Comment 2

[Tyson Smith [:tsmith]]

Verified that this is in both 2.5.5 and the latest released version 2.6.

Comment 3

[Tyson Smith [:tsmith]]

This test case should be a .pcf file (Portable Compiled Format) which we do not support in firefox. So this is likely invalid unless it is used in fxos for some reason.

Comment 4

[Daniel Veditz [:dveditz]]

I don't know that we support this format anywhere. Even if the code is present on FxOS you either have the built-in fonts (which wouldn't be an attack) or downloadable web fonts which are WOFF (opentype).

Comment 5

[Daniel Veditz [:dveditz]]

I don't know that android supports this format either, but we could report it upstream to freetype and AOSP anyway.

Comment 6

[Jonathan Kew [:jfkthame]]

I don't believe AOSP will be directly affected by this either, but it should definitely be reported upstream to freetype.

Comment 7

[Tyson Smith [:tsmith]]

Already reported and fixed upstream.

https://savannah.nongnu.org/bugs/?func=detailitem&item_id=46109