594456 - Crash from fuzzed font in Apple's libTrueTypeScaler [@ fnt_PushSomeWords(fnt_LocalGraphicStateType*, int) ]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Brandon Sterne (:bsterne)]

Attachment: testcase (crashes 1.9.2)

Marc Schoenefeld reported another Mac system font crash from his font fuzzer.  Here is what he sent to security@m.o:

-----

Hi,

looks like the font sanitizing in firefox 3.6.9/OSX is still not sufficient, despite the fixes for mfsa2010-58

I attached a crashwrangler report and a standalone reproducer.

The punch line of the crashwrangler reads like:

exception=EXC_BAD_ACCESS:signal=11:is_exploitable=yes:instruction_disassembly=movl
%eax,(%esi):instruction_address=0x000000009011404d:access_type=write:access_address=0x00000000fedd02b4:
Crash accessing invalid address.  Consider running it again with libgmalloc(3) to see if the log changes.
Test case was dual4_repreat

Is your future strategy to handle the font bugs case wise, or probably introducing stricter acceptance rules via a (better be sandboxed) font sanitizer.

Comment 1

[Brandon Sterne (:bsterne)]

bp-23055d58-3df0-46b9-8fbd-4b3f92100908

Comment 2

[Christoph Diehl [:posidron]]

Does not crash in: Gecko/20100906 Firefox/4.0b6pre

Comment 3

[Christoph Diehl [:posidron]]

Attachment: testcase-reduced

This is a minimal testcase based on the one provided. Perhaps you need to reload the page a couple of times.

Comment 4

[Johnny Stenback (:jst)]

Per Joe these are likely exploitable on trunk with a slightly modified testcase, so marking that this applies to trunk as well.

Comment 5

[Jonathan Kew [:jfkthame]]

This will be fixed by the OTS sanitizer (bug 527276). (The testcase still beachballs for some time, but that's a separate and non-fatal issue.)

Comment 6

[Al Billings [:abillings - ex-MoCo]]

This doesn't crash on 1.9.2.12 on OS X 10.6.5. Is this one of those cases where the 10.6.5 OS X update fixed the Apple side of the problem?

Comment 7

[Jonathan Kew [:jfkthame]]

(In reply to comment #6)
> This doesn't crash on 1.9.2.12 on OS X 10.6.5. Is this one of those cases where
> the 10.6.5 OS X update fixed the Apple side of the problem?

Seems likely; Brandon's crash report from comment #1 is from FF3.6.9 running on 10.6.4.

Comment 8

[Daniel Veditz [:dveditz]]

OTS landed in 1.9.1 as well.