1243597 - (CVE-2016-2795) Use of uninitialised memory in [@graphite2::FileFace::get_table_fn]

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

This was found while fuzzing graphite2 1.3.5 (and is in 1.3.4)

This uninitialised memory can also end up being used in calls to malloc(), fread() and fseek()

NOTE: There is an additional issue at the end of the log, a use of uninitialised memory in graphite2::TtfUtil::CheckTable.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Comment 2

[martin_hosken]

On 64 bit graphite rejects the font as invalid. Was this tested on a different architecture?

Comment 3

[Tyson Smith [:tsmith]]

This was found using a 64-bit build of graphite running under valgrind. When I run this font I see the valgrind errors followed by "Ran graphite2 in 0.001934s (0 glyphs)"

The command I ran was:
$ valgrind -q ./comparerenderer -n -f test_case.ttf -t test_string.txt -s 12

Comment 4

[Tyson Smith [:tsmith]]

Attachment: test_string.txt

Comment 5

[Jonathan Kew [:jfkthame]]

Are the errors perhaps generated during the checking process that ends up rejecting the font?

Comment 6

[martin_hosken]

fixed upstream in a8b3ac2aed0eb132cd80efe7de88f8153e73c829

Comment 7

[Tyson Smith [:tsmith]]

Verified with graphite revision aed0effc27edfb9da441dce3c77f5a1a3fd9f7db