1252407 - Heap-buffer-overflow in ConvertWOFF2ToTTF

Status: VERIFIED FIXED

(Core :: Graphics: Text, defect)

Description

[Chamal De Silva]

Attachment: testfont.html

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36

Steps to reproduce:

1. Download and save corruptFont.woff2 and testfont.html in same folder.
2. Open Firefox built with address sanitizer and open testfont.html.
3. Sometimes tab does not crash. Please reload the page several times if tab does not crash.


Actual results:

Tab crashed with Heap-buffer-overflow.


Expected results:

Tab should not crash.

Comment 1

[Chamal De Silva]

Attachment: corruptFont.woff2

Comment 2

[Chamal De Silva]

This bug is fixed in woff2 library with this revision.
https://github.com/google/woff2/commit/d1efde9124f7bef4b0fd82e98f4702651d3095bc
Please merge or update woff2 used by firefox.

* I could not attach a symbolized back-trace to this bug because so far I could not find how to symbolize ASAN trace generated by Firefox.

Comment 3

[Daniel Veditz [:dveditz]]

Jonathan: do we already have a bug to upgrade WOFF2? What is our usual schedule for that? Do we get alerts about security fixes from them or do we just have to watch on our own?

Comment 4

[Jonathan Kew [:jfkthame]]

We don't currently get alerts, AFAIK; it's up to us to watch. And so I've just added myself as a watcher on the woff2 repository, to try and keep a better eye on it.

I'll post a patch to update our copy shortly.

Comment 5

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 6

[Chamal De Silva]

This is a heap overflow bug, even though ASAN sometimes reports as a UAF.

Comment 7

[Jonathan Kew [:jfkthame]]

Attachment: Update woff2 library to upstream commit 643c7b45891cbeb5dc1f7599a4c9b53fbe82a08f

Comment 8

[Jonathan Kew [:jfkthame]]

Comment on attachment 8725387 [details] [diff] [review]
Update woff2 library to upstream commit 643c7b45891cbeb5dc1f7599a4c9b53fbe82a08f

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
The patch adds a range check, which makes it clear that previously this value was unchecked; hence it's easy to deduce that a rogue font with an out-of-range value here would be a possible attack vector.

It's not immediately clear to me how readily this could be leveraged to something more than an out-of-bounds access that may well result in a crash, but further analysis of the code might indicate that it can be used in more devious ways.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
No

Which older supported branches are affected by this flaw?
None -- the WOFF2 library containing this code landed for mozilla-47 in bug 1227058. The older OTS code was significantly different; it may well have its own flaws, of course, but this particular flaw is specific to the new WOFF2 lib.

If not all supported branches, which bug introduced the flaw?
Bug 1227058 (where we took an OTS update, including switching to the separate WOFF2 module in place of older WOFF2 code within OTS).

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
n/a

How likely is this patch to cause regressions; how much testing does it need?
Minimal risk; this just adds a missing range check.

Comment 9

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33087bab1346dbbfaff79478b7c90e5a978e6ff2
Bug 1252407 - Update woff2 library to upstream commit 643c7b45891cbeb5dc1f7599a4c9b53fbe82a08f. r=fredw

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/33087bab1346

Comment 11

[Chamal De Silva]

Thanks a lot for giving me a reward. Before receiving the bounty I have to disclose you that I reported this bug to google chrome first. I also disclosed google chrome engineers that this bug reproduce in Firefox for the purpose of disclosing this bug to Mozilla.

Comment 12

[Paul Silaghi, QA [:pauly]]

Reproduced on 47.0a1 (2016-03-01) mozilla-central-linux64-asan build.
Verified fixed 47b10 mozilla-central-linux64-asan build.