Closed Bug 1252138 Opened 8 years ago Closed 8 years ago

graphite2: heap-buffer-overflow read in [@cache_subtable<graphite2::TtfUtil::CmapSubtable4NextCodepoint, graphite2::TtfUtil::CmapSubtable4Lookup>]

Categories

(Core :: Graphics: Text, defect)

Product:
Core
Component:
Graphics: Text
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox45 --- disabled
firefox46 --- fixed
firefox47 --- fixed
firefox48 --- fixed
firefox-esr38 46+ disabled
firefox-esr45 46+ disabled

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-bounds, sec-moderate, testcase, Whiteboard: [gfx-noted])

Attachments

(3 files)

call_stack.txt
3.92 KB, text/plain
Details
test_case.ttf
55.95 KB, application/x-font-ttf
Details
test_string.txt
693 bytes, text/plain
Details
Attached file call_stack.txt — 
This was found while fuzzing graphite2 revision fb32e2e39ccd0980672f55052f75fc10f8736fb2
Attached file test_case.ttf — 

    
    

    
  

      
      
      
      

        Attached file
          
        test_string.txt
        — 
      

    


  

    
    

    
  
Fixed with patch from bug 1248876
Status: NEW → RESOLVED
Closed: 8 years ago

          status-firefox45:
          --- → fixed

          status-firefox46:
          --- → fixed

          status-firefox47:
          --- → fixed
Depends on: 1252311
Resolution: --- → FIXED

    
    

    
  
Sigh... wrong bug. Sorry.
Status: RESOLVED → REOPENED

          status-firefox45:
          fixed → ---

          status-firefox46:
          fixed → ---

          status-firefox47:
          fixed → ---
No longer depends on: 1252311
Resolution: FIXED → ---

    
    

    
  
Fixed? in 92e0add6083b2e360e30854cbfceedecaac0d3ad

    
    

    
  
Verified with graphite revision 92e0add6083b2e360e30854cbfceedecaac0d3ad
Whiteboard: [gfx-noted]

    
  
Depends on: 1255158

    
  
Status: REOPENED → RESOLVED
Closed: 8 years ago → 8 years ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release

    
    

    
  
Graphite2 has been updated on all affected branches including ESRs.

          status-firefox45:
          --- → wontfix

          status-firefox46:
          --- → fixed

          status-firefox47:
          --- → fixed

          status-firefox48:
          --- → fixed

          status-firefox-esr38:
          --- → fixed

          status-firefox-esr45:
          --- → fixed

          tracking-firefox-esr38:
          --- → 46+

          tracking-firefox-esr45:
          --- → 46+
Group: core-security-release

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: