580100 - ASSERTION/Crash: font is lacking metrics, we shouldn't be here: '(mNumLongMetrics > 0) && mHmtxTable != nsnull'

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

Build identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; en-US; rv:2.0b2pre) Gecko/20100718 Minefield/4.0b2pre

Table: hhea
Offset: 268/0x10c
Values:
80 00 # metricDataFormat
00 00 # numberOfHMetrics

Load the provided html file.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: testcase

Comment 2

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: patch, v1 - sanity-check hhea fields & hmtx length before using font with harfbuzz

This patch adds some sanity-checking for the metrics tables during initialization, so that we don't risk out-of-bounds indexing when it comes to actually looking up entries.

Comment 4

[John Daggett (:jtd)]

Comment on attachment 458600 [details] [diff] [review]
patch, v1 - sanity-check hhea fields & hmtx length before using font with harfbuzz

Yup, looks good.

Comment 5

[John Daggett (:jtd)]

BTW, I think we need a simple reftest for this.

Comment 6

[Jonathan Kew [:jfkthame]]

Attachment: adding the testcase as a crashtest

Comment 7

[Jonathan Kew [:jfkthame]]

Nominating for blocking2.0 - this provides a means for a corrupt or malicious font to trigger a crash. Patch is low-risk, just improving validation before we use the font data.

Comment 8

[Jonathan Kew [:jfkthame]]

Pushed patch + crashtest:
http://hg.mozilla.org/mozilla-central/rev/676e4798d2b0