Closed Bug 1261135 Opened 8 years ago Closed 8 years ago

graphite2: use of uninitialized memory in [@graphite2::Pass::testConstraint]

Categories

(Core :: Graphics: Text, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla48
Tracking Status
firefox48 --- fixed

People

(Reporter: tsmith, Assigned: jfkthame)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [post-critsmash-triage][adv-main48-])

Attachments

(2 files)

Attached file test_case.ttf
This was found while fuzzing graphite2 revision 313b775d1b80d5a238eff846716ee46e971ef065 (>1.3.8)

To reproduce run:
valgrind -q ./gr2fonttest test_case.ttf -auto -demand -noprint

Conditional jump or move depends on uninitialised value(s)
   at 0x4E5E2BE: graphite2::Pass::testConstraint(graphite2::Rule const&, graphite2::vm::Machine&) const (Pass.cpp:642)
   by 0x4E5D648: graphite2::Pass::findNDoRule(graphite2::Slot*&, graphite2::vm::Machine&, graphite2::FiniteStateMachine&) const (Pass.cpp:509)
   by 0x4E5D033: graphite2::Pass::runGraphite(graphite2::vm::Machine&, graphite2::FiniteStateMachine&, bool) const (Pass.cpp:417)
   by 0x4E66150: graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const (Silf.cpp:423)
   by 0x4E50C27: graphite2::Face::runGraphite(graphite2::Segment*, graphite2::Silf const*) const (Face.cpp:180)
   by 0x4E415E7: graphite2::Segment::runGraphite() (in /home/user/Desktop/graphite/libgraphite2.so.3)
   by 0x4E40DC3: (anonymous namespace)::makeAndInitialize(graphite2::Font const*, graphite2::Face const*, unsigned int, graphite2::FeatureVal const*, gr_encform, void const*, unsigned long, int) (gr_segment.cpp:46)
   by 0x4E40FDE: gr_make_seg (gr_segment.cpp:105)
   by 0x4044CD: Parameters::testFileFont() const (gr2FontTest.cpp:691)
   by 0x404F22: main (gr2FontTest.cpp:797)
 Uninitialised value was created by a stack allocation
   at 0x4E65B4B: graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const (Silf.cpp:356)
Fixed? in 56157cf9845d13452068c297205f96b946126cc2
Verified with graphite revision 56157cf9845d13452068c297205f96b946126cc2
This is simple enough that I think we should just go ahead and take it, without needing to wait for a further upstream release.
Attachment #8739105 - Flags: review?(jmuizelaar)
Assignee: nobody → jfkthame
Status: NEW → ASSIGNED
Attachment #8739105 - Flags: review?(jmuizelaar) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/6af7c50ac3d3822f86f7ed8e17b59f0520346a0a
Bug 1261135 - Cherry-pick commit 56157cf9845d13452068c297205f96b946126cc2 from graphite2 upstream. r=jrmuizel
https://hg.mozilla.org/mozilla-central/rev/6af7c50ac3d3
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
Group: gfx-core-security → core-security-release
Whiteboard: [post-critsmash-triage]
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main48-]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.