576997 - Need to upgrade in-tree FreeType to 2.4.0 once it has been released

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Reed Loden [:reed]]

Robert Święcki of Google Switzerland GmbH reported multiple (possibly security-related) bugs in FreeType 2.3.12 and earlier. Once FreeType 2.4.0 has been released, we need to upgrade our in-tree copies to ensure we have the fixes for these issues. Filing this as a tracker bug to ensure we do that and don't miss it.

Comment 1

[Reed Loden [:reed]]

Is anything on 1.9.2 or 1.9.1 using the in-free FreeType yet?

Comment 2

[Robert Swiecki]

I recommend checking out the http://code.google.com/p/ots/ - as far as i know it's been written to support OTF/TTF/WOFF in chromium. But the library is pretty portable, so maybe you should think about using it as well (none of the bugs I've reported affects chromiu, even though it's using freetype under linux/macos)

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We don't use in-tree Freetype in any desktop build. We may be using it on some mobile builds, I'm not sure.

Comment 4

[Brad Lassey [:blassey] (use needinfo?)]

(In reply to comment #3)
> We don't use in-tree Freetype in any desktop build. We may be using it on some
> mobile builds, I'm not sure.

We haven't had an official release using in-tree freetype yet

Comment 5

[Robert Swiecki]

Well, libots is a very robust sanitizer. It's not only protecting against libfreetype bugs (I managed to find only one that passed libots verigication, a NULL-ptr  deref. in freetype, but it's already been fixed). I think that it's even more useful when protecting Windows' in-kernel font renderer (sic!:). Not sure what firefox is using on windows to render fonts, but if it's this ingenious Microsoft's idea of ring-0 font renderer, then I'd use some sanitizer ;).

Comment 6

[Robert Swiecki]

> it's this ingenious Microsoft's idea of ring-0 font renderer,
> then I'd use some sanitizer ;).

Oh... and in the light of recent Microsoft's PR wars against security researchers: This is solely my opinion; it does not necessarily reflect opinions of my employer etc. etc.. :)

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yeah, it might make a lot of sense to use a sanitizer before we pass downloaded fonts to the system glyph rasterizer. That should be treated as a separate issue though.

Comment 8

[Benjamin Smedberg]

This blocks android only.

Comment 9

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: patch to update to 2.4.1

Comment 10

[Benjamin Smedberg]

FT 2.4.1 is released, no need to keep this bug hidden.

Comment 11

[Brad Lassey [:blassey] (use needinfo?)]

pushed http://hg.mozilla.org/mozilla-central/rev/9eed0fe868f1