959578 - OTS accepts subtable offsets inside the GDEF/GSUB header

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Frédéric Wang (:fredw)]

While trying to implement support for the MATH table (bug 407059), I realized that the size of the GDEF header is not computed correctly. It is set to 8 (10 in version 2) while it should be 12 (14 in version 2). It seems that the 4 bytes for the Version number have been forgotten in the computation.

This means that GlyphClassDef, AttachList, LigCaretList, MarkAttachClassDef and MarkGlyphSetsDef offsets may incorrectly point toward the two last bytes of the GDEF header.

I'm opening this as a security bug, but I don't think it is really exploitable since either the parsing of the subtable will fail or the subtable will be parsable without problem.

I will also report this upstream.

Comment 1

[Frédéric Wang (:fredw)]

Attachment: ots-gdef.diff

Comment 2

[Jonathan Kew [:jfkthame]]

LGTM, thanks.

Given that it's not a critical security issue, I'd prefer to take it as part of an OTS update rather than a local patch. However, if upstream doesn't respond and apply the fix soon, we could take it locally as a temporary fix.

Comment 3

[Frédéric Wang (:fredw)]

Patch landed upstream:
https://code.google.com/p/ots/source/detail?r=109

Comment 4

[Frédéric Wang (:fredw)]

Fixed by bug 941019.