1689395 - Cherry-pick OTS 'maxp' sanitization from upstream to ESR

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Jonathan Kew [:jfkthame]]

OTS commits b703837f4dda38239d and 1141c81c411b599e are not present in ESR78; to protect against a known (though not yet public, afaik) issue in DirectWrite, we should cherry-pick these and apply to the version of OTS in the ESR tree.

(On trunk we have a more recent OTS already that includes this fix.)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1689395 - Backport some upstream OTS commits. r=jfkthame

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9199826 [details]
Bug 1689395 - Backport some upstream OTS commits. r=jfkthame

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Protects against a DirectWrite vulnerability reported to us by Google
• User impact if declined: Users on unpatched Windows versions will be potentially vulnerable
• Fix Landed on Version: 86
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just rejects certain malformed fonts to avoid triggering the Windows bug. Fix is already in 86+ by way of the OTS library update in bug 1685381.
• String or UUID changes made by this patch: N/A

Comment 3

[Jonathan Kew [:jfkthame]]

cc'ing Dominik at Google, who was involved in fixing this upstream and notifying us about it (thanks!).

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9199826 [details]
Bug 1689395 - Backport some upstream OTS commits. r=jfkthame

Approved for 78.8esr.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/cc7a75e521ee

Comment 6

[Jonathan Kew [:jfkthame]]

Microsoft's disclosure of the relevant Windows issue: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24093.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 8

[Tom Ritter [:tjr]]

Actually; because this is not a vulnerability in Firefox; but rather a lack of a mitigation for an OS vuln, I don't think it needs an advisory.

Comment 9

[Dominik Röttsches (drott)]

More details on the bug now unrestricted in the Project Zero bugtracker: https://bugs.chromium.org/p/project-zero/issues/detail?id=2123