803498 - Graphite2 crash [@graphite2::Silf::readGraphite]

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

Table: b'Sill'
Number of values: 2
Offset:          8/0x000008	Value: ['ff', 'ff', 'ff', 'fe']
Offset:         14/0x00000e	Value: ['20', '00']
Table: b'Silf'
Number of values: 4
Offset:         15/0x00000f	Value: ['40', '00']
Offset:         18/0x000012	Value: ['00', '00', '00', '00']
Offset:         42/0x00002a	Value: ['7f', 'fe']
Offset:         60/0x00003c	Value: ['7f', 'fe']

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Jonathan Kew [:jfkthame]]

Is this consistently reproducible for you, or is it unpredictable how long it may run before it reports a problem?

Comment 3

[Jonathan Kew [:jfkthame]]

Never mind, confirmed that this is readily reproducible using a current ASAN build (from https://people.mozilla.com/~choller/firefox/asan/20121019-mozilla-central-macosx64-debug-0ff60bfb3442+asan.html) with graphite enabled in about:config.

Comment 4

[Jonathan Kew [:jfkthame]]

I think this will be fixed by the library update in bug 803347 - we should re-test once we have ASAN builds with that patch.

Comment 5

[Christoph Diehl [:posidron]]

(In reply to Jonathan Kew (:jfkthame) from comment #4)
> I think this will be fixed by the library update in bug 803347 - we should
> re-test once we have ASAN builds with that patch.

Nope, did not fix this problem.

Comment 6

[Jonathan Kew [:jfkthame]]

Drat. OK, thanks for checking; will follow up with the graphite team.

Comment 7

[Jonathan Kew [:jfkthame]]

Attachment: update graphite2 lib to commit 3d5f7268b2c4.

See upstream changelog at http://hg.palaso.org/graphitedev for details.

Comment 8

[Jonathan Kew [:jfkthame]]

This will be superseded by bug 805760, which updates us to a more recent upstream commit and has just landed on m-i.

Comment 9

[Jonathan Kew [:jfkthame]]

Fixed by bug 805760.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

How is this "disabled" for 18 but bug 803347 is not when they are both graphite2 crashes?

Comment 11

[Jonathan Kew [:jfkthame]]

All graphite2-related bugs are "disabled" for current branches, in the sense that the feature is preffed off by default, so the code is only reachable if a user has explicitly turned it on through about:config.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

That's good to know. That changes the measure of how we discuss this for advisories as a security issue.