596110 - Malformed font leads to crash in Apple's libTrueTypeScaler [@fnt_ALIGNRP]

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

Tag: b'fpgm' Checksum: 0x00010645 Offset:  348/0x0000015c Length: 950

Table: b'fpgm'
Number of replaced values: 2
Offset:   313/0x000139	Value: ['ff', 'c4', '40', '0f']
Offset:   895/0x00037f	Value: ['00', '00', '00', '01']

The decompiled fpgm table is included in the archive.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[John Daggett (:jtd)]

Fixed in 10.6.5 10H542 (seed build)

Comment 3

[Jonathan Kew [:jfkthame]]

This will be fixed by the OTS sanitizer (bug 527276).

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Verified fixed in 1.9.2.13 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6;
en-US; rv:1.9.2.13pre) Gecko/20101118 Namoroka/3.6.13pre using testcase. Test
no longer crashes as it does in 1.9.2.12.

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Oops, typo in the wrong tab. I haven't verified this yet as I need to find a 10.6.4 machine.

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Verified fixed for 1.9.2.13 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.13pre) Gecko/20101119 Namoroka/3.6.13pre. Crashes in
1.9.2.12 when run on OS X 10.6.4.