1034230 - [cairo] Potential use of uninitialized |stack| in cairo_type1_font_subset_look_for_seac

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Eric Rahm [:erahm]]

In  |cairo_type1_font_subset_look_for_seac| under case TYPE1_CHARSTRING_COMMAND_SEAC |stack[3]| and |stack[4]| are accessed with no guarantee they are initialized.

http://dxr.mozilla.org/mozilla-central/source/gfx/cairo/cairo/src/cairo-type1-subset.c#842,873,877

Comment 1

[Jonathan Kew [:jfkthame]]

It looks like this code has been significantly revised in upstream cairo, and no longer contains this flaw. (Compare http://cgit.freedesktop.org/cairo/tree/src/cairo-type1-subset.c.)

Comment 2

[Jonathan Kew [:jfkthame]]

Attachment: handle bad 'seac' in type1 charstring.

If we want to patch this locally, I think a simple check on |sp| is all we need.

Comment 3

[Jonathan Kew [:jfkthame]]

AFAICS, there's not likely to be a major security issue here. If we encounter a type1 font with an incorrectly-used seac operator, and run the subsetting code here (e.g. to generate a PDF?), it's possible we'll collect the wrong glyphs in the subset to be embedded, and end up with something that doesn't render entirely correctly, but that's probably all the badness that'll happen.

If so, I guess this could be rated sec-low. Does that sound reasonable to you, Jeff?

Comment 4

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/170873fd6b99

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/170873fd6b99

Comment 6

[Matt Wobensmith [:mwobensmith][:matt:]]

Rating of sec-low + found by code audit via Coverity = [qe-verify-].