573449 - Invalid instruction in TTF's fpgm table leads to crash [@ fnt_CALL]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

Not sure whether it belongs here.

Invalid instruction is in this case: 0x7fff at offset: 0x19c

Also affected: 
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a6pre) Gecko/20100620 Minefield/3.7a6pre (x86-64)


Reproducible: Always

Steps to Reproduce:
Load the provided html file.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: testcase (HTML + TTF)

Comment 2

[Christoph Diehl [:posidron]]

Attachment: Callstack (x86) Firefox/3.6.3

Comment 3

[Christoph Diehl [:posidron]]

Attachment: Callstack x86-64 Minefield/3.7a6pre

Comment 4

[Jesse Ruderman]

Looks scary based on "KERN_INVALID_ADDRESS at address: 0x00000001345b6e5a".

Comment 5

[Jesse Ruderman]

Comment on attachment 452685 [details]
Callstack (x86) Firefox/3.6.3

To get a useful stack out of a release build, you need to use Breakpad or the symbol server.  Or you can build your own version.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Jonathan, you'd better look into this.

Comment 7

[Jonathan Kew [:jfkthame]]

It's crashing deep inside Apple's ATS code. I doubt it's realistically possible for us to validate all TrueType bytecode before we allow a font to be used, so we may not be able to do anything about it for FF3.6, where we rely on the (deprecated) ATS and ATSUI APIs for all font handling.

However, Core Text does not appear to be affected by this, so on trunk we could resolve it if we eliminate the remaining dependency on ATS, which is currently used to get font metrics. The patch in bug 532533 does this for all TrueType/OpenType fonts, replacing the use of ATSFontGetHorizontalMetrics with code to read the font tables directly.

(That patch needs updating for current trunk; I've done this locally, and checked that the testcase here renders properly and doesn't crash, but need to check the patch more carefully before I post an update version.)

Comment 8

[Jesse Ruderman]

We've had pretty bad luck trying to get Apple to fix security bugs in ATS, so moving all the way to Core Text sounds like the way to go.

Comment 9

[Jesse Ruderman]

Opera crashes too.  Safari and Chrome don't.

Comment 10

[Jonathan Kew [:jfkthame]]

Bug 532533 now has an updated patch that fixes this issue.

Comment 11

[John Daggett (:jtd)]

(In reply to comment #10)
> Bug 532533 now has an updated patch that fixes this issue.

Er, not quite.  See bug 532533, comment 74.

Comment 12

[John Daggett (:jtd)]

Logged as radar 8125396.

Comment 13

[Jonathan Kew [:jfkthame]]

(In reply to comment #11)
> (In reply to comment #10)
> > Bug 532533 now has an updated patch that fixes this issue.
> 
> Er, not quite.  See bug 532533, comment 74.

True. But now it does. :) See bug 532533, comment 78.

Comment 14

[Jonathan Kew [:jfkthame]]

This is fixed by the patch for bug 532533.