1243816 - (CVE-2016-2796) graphite2: heap-buffer-overflow write in [@graphite2::vm::Machine::Code::Code]

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

This was found while fuzzing graphite2 1.3.5 (and is in 1.3.4)

This is likely sec-critical.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 2

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Comment 3

[Tyson Smith [:tsmith]]

Attachment: test_case.ttf

Comment 4

[Tyson Smith [:tsmith]]

Attachment: gr2_test_string.txt

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking since this likely affects all channels including esr38 and it's sec-critical.

Comment 6

[Jonathan Kew [:jfkthame]]

There's a patch in bug 1243843 (awaiting testing) that may well fix this.

Comment 7

[martin_hosken]

fixed upstream in a8b3ac2aed0eb132cd80efe7de88f8153e73c829

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Does that mean we can close this bug? Tyson can you or someone else verify this is fixed?

Comment 9

[Jonathan Kew [:jfkthame]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #8)
> Does that mean we can close this bug? Tyson can you or someone else verify
> this is fixed?

I believe so based on Martin's comment, but would appreciate having it verified on our latest builds.

Comment 10

[Tyson Smith [:tsmith]]

This crash is still reproducible with the latest fixes (e569e28d83491fedb31b9220493f3c07f6ec6d80)

Comment 11

[Jonathan Kew [:jfkthame]]

Martin, can you look into this again, please?

Comment 12

[martin_hosken]

I have a potential fix, needs review internally. Should be fixed in 24hrs. This bug would be hard to make anything of.

Comment 13

[martin_hosken]

This and all friends fixed upstream. Sorry, I forgot to do asan testing last time around :( This time they all run asan clean on 64bit.

Comment 14

[martin_hosken]

Fixed upstream in 703cbd0c5bd23f39ff24d5d2a525b18658cdb59a

Comment 15

[Tyson Smith [:tsmith]]

Verified with graphite revision c8450dbaa160be5c939d9abb5cfe01284e22b45f