Closed Bug 2053326 (CVE-2026-16357) Opened 3 months ago Closed 3 months ago

COLRv1 ItemVariationData extent overflow causes web-font OOB read on Windows x86

Tracking

()

Status:

RESOLVED FIXED

Milestone:

154 Branch

Tracking Flags:

Tracking

Status

firefox-esr115

153+

fixed

firefox-esr140

153+

fixed

firefox152

---

wontfix

firefox153

fixed

firefox154

fixed

People

(Reporter: 5up3rh3i, Assigned: jfkthame, NeedInfo)

Details

(Keywords: csectype-bounds, reporter-external, sec-moderate, Whiteboard: [client-bounty-form][adv-main153+][adv-ESR140.13+][adv-ESR115.38+])

Attachments

(14 files)

inner2.html 3 months ago hajim 380 bytes, text/html		Details
colrv1_x86_varstore_inner2.ttf 3 months ago hajim 1.46 MB, font/ttf		Details
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr140+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr140+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr140+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr115+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr115+	Details \| Review
(secure) 3 months ago Jonathan Kew [:jfkthame] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr115+	Details \| Review

hajim

Reporter

Description

•

3 months ago

Attached file inner2.html — Details

Summary

Firefox accepts a malformed COLRv1 web font on Windows x86 while the same font is rejected on x64. The accepted x86 font reaches COLRv1 variation rendering and crashes a sandboxed content process with an out-of-bounds read in COLRFonts.cpp.

The malformed font uses an ItemVariationData record whose logical delta-set byte extent is larger than the physical COLR table. On Windows x86, validation arithmetic wraps and the font is accepted. Rendering then computes a delta-set pointer from the attacker-controlled variation index and reads outside the valid table data.

The trigger is a normal web path: a page loads the font with @font-face and renders text.

Tested Build

Firefox source commit: cea5f8cacbe1ba3c8c95a7b17a309ce6704a4c7d
Affected platform: Windows x86 Firefox build
Control platform: Windows x64 Firefox build
Firefox version: 154.0a1
Build ID: 20260627203348

Affected Code

gfx/ots/src/variations.cc
gfx/thebes/COLRFonts.cpp

OTS validates the variation data subtable with multiplication in size_t:

if (!subtable.Skip(valueSize * size_t(itemCount) *
                   (size_t(wordDeltaCount) + size_t(*regionIndexCount)))) {
  return OTS_FAILURE_MSG("Failed to read delta data");
}

Gecko's COLRv1 validator and consumer then compute delta-set extents and delta-set pointers:

uint32_t deltaSetSize =
    (uint16_t(regionIndexCount) + uint16_t(wordDeltaCount)) << longWords;

const uint8_t* deltaData =
    reinterpret_cast<const uint8_t*>(deltaSets) + deltaSetSize * innerIndex;

Root Cause

The validation path does not enforce an overflow-safe logical extent for ItemVariationData delta sets on 32-bit builds.

PoC parameters:

regionIndexCount = 32768
wordDeltaCount   = 0x8001  (LONG_WORDS | 1)
itemCount        = 65535
deltaSetSize     = (32768 + 1) << 1 = 65538 bytes
logical extent   = 65535 * 65538 = 4,295,032,830 bytes
physical COLR table length: about 1.5 MB

The logical delta array cannot fit inside the COLR table. On Windows x86, the relevant pointer/extent arithmetic wraps and validation accepts the font. On x64, the same font is rejected.

After acceptance on x86, ApplyVariation() uses the variation index to derive a deltaData pointer and reads outside the valid table contents.

Proof of Concept

Attached files:

poc/colrv1_x86_varstore_inner2.ttf
poc/inner2.html

Run Firefox x86 against inner2.html. The page loads the attached font through @font-face and renders text that reaches the COLRv1 variation code.

Evidence

The malformed font is accepted on x86:

{
  "arch": "x86",
  "fontsStatus": "loaded",
  "faces": [{"family": "XColr", "status": "loaded"}],
  "check": true
}

The same malformed font is rejected on x64:

{
  "arch": "x64",
  "fontsStatus": "loaded",
  "faces": [{"family": "XColr", "status": "error"}],
  "check": false
}

The crash is a content-process out-of-bounds read while rendering the web font:

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ

Thread 0 MainThread (crashed)
 0  xul.dll!(anonymous namespace)::ApplyVariation(...) [COLRFonts.cpp:452]
 1  xul.dll!(anonymous namespace)::PaintVarRadialGradient::MakePattern(...) [COLRFonts.cpp:1176]
 2  xul.dll!(anonymous namespace)::DispatchMakePattern(...) [COLRFonts.cpp:2023]
 3  xul.dll!(anonymous namespace)::PaintGlyph::Paint(...) [COLRFonts.cpp:1300]
 5  xul.dll!(anonymous namespace)::PaintColrGlyph::DoPaint(...) [COLRFonts.cpp:1363]
 6  xul.dll!mozilla::gfx::COLRFonts::PaintGlyphGraph(...) [COLRFonts.cpp:2554]
 7  xul.dll!gfxFont::RenderColorGlyph(...) [gfxFont.cpp:2795]
 8  xul.dll!gfxFont::DrawOneGlyph<1>(...) [gfxFont.cpp:2223]
 10 xul.dll!gfxFont::Draw(...) [gfxFont.cpp:2627]
 12 xul.dll!gfxTextRun::Draw(...) [gfxTextRun.cpp:680]
 15 xul.dll!nsTextFrame::DrawText(...) [nsTextFrame.cpp:8232]
 16 xul.dll!nsTextFrame::PaintText(...) [nsTextFrame.cpp:7905]

Crash metadata:

ProductName=Firefox
Version=154.0a1
BuildID=20260627203348
ProcessType=content
ContentSandboxLevel=9
ContentSandboxWin32kState=Win32k Lockdown enabled

Security Impact

A web page can provide a malformed COLRv1 font and trigger a content-process out-of-bounds read on Windows x86 Firefox during normal text rendering. The report does not claim code execution or an out-of-bounds write.

Suggested Fix

Use checked arithmetic for all ItemVariationData extent calculations in both OTS and Gecko's COLRv1 validation. Reject any table whose logical delta-set array does not fit inside the COLR table before any pointer addition. The same checked extent should be used by ApplyVariation() before computing deltaSetSize * innerIndex.

Flags: sec-bounty?

hajim

Reporter

Comment 1

•

3 months ago

Attached file colrv1_x86_varstore_inner2.ttf — Details

COLRv1 ItemVariationData extent overflow causes web-font OOB read on Windows x86

Summary

Tested Build

Affected Code

Root Cause

Proof of Concept

Evidence

Security Impact

Suggested Fix

firefox-beta Uplift Approval Request

firefox-esr140 Uplift Approval Request

firefox-esr115 Uplift Approval Request