Closed Bug 598190 Opened 12 years ago Closed 12 years ago

Malformed font leads to crash [@CFRetain]

Categories

(Core :: Graphics, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+
status1.9.2 --- unaffected

People

(Reporter: posidron, Assigned: jfkthame)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

Attached file testcase
Table: b'glyf'
Number of replaced values: 4
Offset:  7253/0x001c55	Value: ['00', '00', '00', '00', '00', '00', '00', '01']
Offset: 18775/0x004957	Value: ['ff', 'c4', '40', '0f']
Offset: 18791/0x004967	Value: ['ff', 'c4', '40', '0f']
Offset: 75698/0x0127b2	Value: ['ff', 'ff', 'ff', 'ff']

Firefox 1.9.2 is not affected.

ProductName:	Mac OS X
ProductVersion:	10.6.4
BuildVersion:	10F569
Attached file callstack
Assignee: nobody → jdaggett
blocking2.0: --- → ?
This will be fixed by the OTS sanitizer (bug 527276).
Depends on: CVE-2010-3768
blocking2.0: ? → final+
Assignee: jdaggett → jfkthame
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
If 1.9.2 isn't affected, why are we marking this as fixed in 1.9.2.13?

I've confirmed that the testcase does nothing in 1.9.2.12.
(In reply to comment #3)
> If 1.9.2 isn't affected, why are we marking this as fixed in 1.9.2.13?

Hmm, that looks like an oversight - as it's fixed by the sanitizer in the same way as lots of other fuzzed-font bugs that *do* affect 1.9.2.

> I've confirmed that the testcase does nothing in 1.9.2.12.

OK; we could mark it "unaffected" instead.
You need to log in before you can comment on or make changes to this bug.