Closed
Bug 598190
Opened 14 years ago
Closed 14 years ago
Malformed font leads to crash [@CFRetain]
Categories
(Core :: Graphics, defect)
Tracking
()
RESOLVED
FIXED
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | final+ |
| status1.9.2 | --- | unaffected |
People
(Reporter: posidron, Assigned: jfkthame)
References
(Blocks 1 open bug)
Details
Attachments
(2 files)
Table: b'glyf'
Number of replaced values: 4
Offset: 7253/0x001c55 Value: ['00', '00', '00', '00', '00', '00', '00', '01']
Offset: 18775/0x004957 Value: ['ff', 'c4', '40', '0f']
Offset: 18791/0x004967 Value: ['ff', 'c4', '40', '0f']
Offset: 75698/0x0127b2 Value: ['ff', 'ff', 'ff', 'ff']
Firefox 1.9.2 is not affected.
ProductName: Mac OS X
ProductVersion: 10.6.4
BuildVersion: 10F569
|
Reporter | |
Comment 1•14 years ago
|
||
|
||
Updated•14 years ago
|
Assignee: nobody → jdaggett
|
||
Updated•14 years ago
|
blocking2.0: --- → ?
|
Assignee | |
Comment 2•14 years ago
|
||
This will be fixed by the OTS sanitizer (bug 527276).
Depends on: CVE-2010-3768
|
||
Updated•14 years ago
|
blocking2.0: ? → final+
|
|
Assignee | |
Updated•14 years ago
|
Assignee: jdaggett → jfkthame
Status: NEW → RESOLVED
Closed: 14 years ago
status1.9.2:
--- → .13-fixed
Resolution: --- → FIXED
|
||
Comment 3•14 years ago
|
||
If 1.9.2 isn't affected, why are we marking this as fixed in 1.9.2.13?
I've confirmed that the testcase does nothing in 1.9.2.12.
|
|
Assignee | |
Comment 4•14 years ago
|
||
(In reply to comment #3)
> If 1.9.2 isn't affected, why are we marking this as fixed in 1.9.2.13?
Hmm, that looks like an oversight - as it's fixed by the sanitizer in the same way as lots of other fuzzed-font bugs that *do* affect 1.9.2.
> I've confirmed that the testcase does nothing in 1.9.2.12.
OK; we could mark it "unaffected" instead.
|
|
Reporter | |
Updated•13 years ago
|
Blocks: fuzzing-fonts
You need to log in
before you can comment on or make changes to this bug.
Description
•