Closed Bug 594618 Opened 14 years ago Closed 14 years ago

Malformed font leads to crash in Apple's libTrueTypeScaler [@fnt_DeltaEngine]

Categories

(Core :: Graphics, defect)

1.9.2 Branch
x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+
status1.9.2 --- .13-fixed
status1.9.1 --- .16-fixed

People

(Reporter: posidron, Assigned: jfkthame)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

Attached file testcase
Number of replaced values: 4
Offset:  25155/0x006243  Value: ['40', '00']
Offset:  82771/0x014353  Value: ['7f', 'ff', 'ff', 'ff']
Offset: 132717/0x02066d  Value: ['ff', 'ff', 'ff', 'ff']
Offset: 135462/0x021126  Value: ['ff', 'c4', '40', '0f']

Execute the provided html file.
Attached file callstack
blocking2.0: --- → ?
Assignee: nobody → jdaggett
Summary: Malformed font leads to crash [@fnt_DeltaEngine] → Malformed font leads to crash in Apple's libTrueTypeScaler [@fnt_DeltaEngine]
blocking2.0: ? → final+
Fixed in 10.6.5 10H542 (seed build)
This will be fixed by the OTS sanitizer (bug 527276).
Depends on: CVE-2010-3768
Assignee: jdaggett → jfkthame
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.