1243473 - (CVE-2016-2791) graphite2: heap-buffer-overflow read in [@graphite2::GlyphCache::glyph]

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

This was found while fuzzing graphite2 1.3.5 (and is in 1.3.4)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Comment 2

[martin_hosken]

What is the test string for this: "Whereas" seems to render correctly.

Comment 3

[Tyson Smith [:tsmith]]

Attachment: test_string.txt

Comment 4

[martin_hosken]

fixed upstream in e569e28d83491fedb31b9220493f3c07f6ec6d80

Comment 5

[Tyson Smith [:tsmith]]

Verified with e569e28d83491fedb31b9220493f3c07f6ec6d80

Comment 6

[Daniel Veditz [:dveditz]]

Tyson: what mozilla-central commit (or bug) fixed this crash? If you're testing the upstream changeset it's good to validate the patch, but it's not yet fixed in Mozilla. Once we know the relevant commit (which might be a "upgrade graphite2 to cset xxxxx" bug) then we can check to make sure that landed in all the branches we need it to land in.

Comment 7

[Tyson Smith [:tsmith]]

(In reply to Daniel Veditz [:dveditz] from comment #6)
> Tyson: what mozilla-central commit (or bug) fixed this crash? If you're
> testing the upstream changeset it's good to validate the patch, but it's not
> yet fixed in Mozilla. Once we know the relevant commit (which might be a
> "upgrade graphite2 to cset xxxxx" bug) then we can check to make sure that
> landed in all the branches we need it to land in.

Oops I don't know what I was thinking there. You are right this still isn't in mozilla-central