{"action":"closed","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/166","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/166/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/166/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/166/events","html_url":"https://github.com/chrsmith/google-security-research/issues/166","id":58937055,"number":166,"title":"FreeType 2.5.3 SFNT parsing integer overflows","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-9667","name":"CVE-2014-9667","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-mjurczyk","name":"Finder-mjurczyk","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-FreeType","name":"Product-FreeType","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Nov-12","name":"Reported-2014-Nov-12","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-Low","name":"Severity-Low","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-25T17:17:02Z","updated_at":"2015-02-25T17:17:02Z","closed_at":"2015-02-25T17:17:02Z","body":"```\nIn the freetype/src/sfnt/ttload.c file responsible for handling SFNT tables, \nthere are potential integer overflow conditions in the following code snippets:\n\n209:      /* we ignore invalid tables */\n210:      if ( table.Offset + table.Length > stream->size )\n211:      {\n212:        FT_TRACE2(( \"check_table_dir: table entry %d invalid\\n\", nn ));\n213:        continue;\n214:      }\n215:      else\n216:        valid_entries++;\n\nand\n\n397:     /* ignore invalid tables */\n398:      if ( entry->Offset + entry->Length > stream->size )\n399:        continue;\n400:      else\n401:      {\n402:        FT_TRACE2(( \"  %c%c%c%c  %08lx  %08lx  %08lx\\n\",\n403:                    (FT_Char)( entry->Tag >> 24 ),\n404:                    (FT_Char)( entry->Tag >> 16 ),\n405:                    (FT_Char)( entry->Tag >> 8  ),\n406:                    (FT_Char)( entry->Tag       ),\n407:                    entry->Offset,\n408:                    entry->Length,\n409:                    entry->CheckSum ));\n410:        entry++;\n411:      }\n\nSince both \"Offset\" and \"Length\" fields are fully controlled 32-bit unsigned \nintegers, their sum can overflow the integer ranges on 32-bit builds of \nFreeType, effectively bypassing the sanity above checks.\n\nThe full consequence of not correctly filtering out such malformed tables is \nnot fully understood; we assume, however, that the worst that could happen as a \nresult of this issue is an out-of-bounds read from the table of an allegedly \nenormous size (while in reality much smaller). We believe installing proper \nbounds checking should be a good defense-in-depth measure to prevent further \nbugs related to such bogus table headers.\n```\n\n-----\nOriginal issue reported on code.google.com by `mjurc...@google.com` on 12 Nov 2014 at 5:41"}}