594638 - Malformed font leads to crash in Apple's libTrueTypeScaler [@small_free_list_remove_ptr]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

This one is perhaps a dublicate, I am not exactly sure.

Number of replaced values: 8
Offset:  21699/0x0054c3	Value: ['49']
Offset:  22109/0x00565d	Value: ['d5', '14']
Offset:  22571/0x00582b	Value: ['e8', 'd5']
Offset:  25634/0x006422	Value: ['d1', 'b9', 'fc', '2c']
Offset:  30069/0x007575	Value: ['8f', 'f0', '59', 'c8']
Offset:  35475/0x008a93	Value: ['f7', 'f1', '75']
Offset:  36115/0x008d13	Value: ['28', 'a4']
Offset:  39160/0x0098f8	Value: ['64', '45', '95', '40']

Execute the provided html file.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Johnny Stenback (:jst)]

Per Joe these are likely exploitable on trunk with a slightly modified testcase, so marking that this applies to trunk as well.

Comment 3

[John Daggett (:jtd)]

Fixed in 10.6.5 10H542 (seed build)

Comment 4

[Jonathan Kew [:jfkthame]]

This will be fixed by the OTS sanitizer (bug 527276).

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Verified fixed for 1.9.2.13 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13pre) Gecko/20101119 Namoroka/3.6.13pre. Crashes in 1.9.2.12 when run on OS X 10.6.4.

Comment 6

[Daniel Veditz [:dveditz]]

OTS landed in 1.9.1 as well.