574368 - Invalid descriptorCount/gxFontDescriptor value in TTF's fdsc table leads to crash [@ GetFontMetrics()]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a6pre) Gecko/20100624 Minefield/3.7a6pre

Invalid value is in this case: 00 00 00 01 41 41 41 41

Reproducible: Always

Steps to Reproduce:
Load the provided html file.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: testcase

Comment 2

[Christoph Diehl [:posidron]]

Attachment: Callstack x86-64 Minefield/3.7a6pre

Comment 3

[Christoph Diehl [:posidron]]

Edit:

at offset: 0x19c

Comment 4

[Jonathan Kew [:jfkthame]]

I'm curious to know if this testcase also causes problems for Safari, or for other applications (if the font is installed locally on the machine)?

Comment 5

[Christoph Diehl [:posidron]]

Yes. FontBook (Font import tool) / Safari etc. can not handle the font. I know , it's not a Firefox issue but the bug acts like a proxy, so I thought it would be of interest.

Comment 6

[Christoph Diehl [:posidron]]

Attachment: Callstack Safari V5.0 (6533.16)

Comment 7

[Jesse Ruderman]

cd, can you report this bug to Apple using https://bugreport.apple.com/, and put a rdar://NUM link in the whiteboard?

Comment 8

[Jonathan Kew [:jfkthame]]

There's a tryserver build at http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-264b39e314fc/ with an enhanced version of the patch in bug 532533 that tries to avoid use of any Apple font metrics APIs. I'd be interested to know if the crash is still reproducible with this build.

Comment 9

[Christoph Diehl [:posidron]]

Yes

Comment 10

[Christoph Diehl [:posidron]]

Attachment: Callstack - TryServer;Minefield 4.0b2pre (64bit)

Comment 11

[Jonathan Kew [:jfkthame]]

(In reply to comment #10)
> Callstack - TryServer;Minefield 4.0b2pre (64bit)

Ok, thanks. Hmmm, the frames between gfxTextRun::SetSpaceGlyph and CGFontGetGlyphAdvances are completely wrong here; I guess it didn't have enough symbols. But anyway, it's pretty clear what's happening - although this build avoided calling CGFontGetUnitsPerEm directly, it still hit that function via CGFontGetGlyphAdvances while getting the width of the space glyph.

Comment 12

[Jonathan Kew [:jfkthame]]

This should be fixed by bug 527276.

Comment 13

[Jonathan Kew [:jfkthame]]

Checked that OTS (bug 527276) resolves this, and the testcase no longer crashes. (However, 1.9.2 and 1.9.1 will remain vulnerable until we get OTS landed there as well.)