{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/107","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/107/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/107/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/107/events","html_url":"https://github.com/chrsmith/google-security-research/issues/107","id":58936680,"number":107,"title":"Microsoft Office 2007 TTDeleteEmbeddedFont handle double delete","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-6333","name":"CVE-2014-6333","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-hawkes","name":"Finder-hawkes","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2014-Nov-11","name":"Fixed-2014-Nov-11","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/MSRC-20387","name":"MSRC-20387","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-Office-2007","name":"Product-Office-2007","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Sep-15","name":"Reported-2014-Sep-15","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Microsoft","name":"Vendor-Microsoft","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-25T17:14:53Z","updated_at":"2015-02-25T17:14:53Z","closed_at":"2015-02-25T17:14:53Z","body":"```\nThe following access violation was observed in Microsoft Office 2007:\n\n(7a4.808): Access violation - code c0000005 (first chance)\nFirst chance exceptions are reported before any exception handling.\nThis exception may be expected and handled.\neax=00000001 ebx=feeefeee ecx=7ffdf000 edx=00150608 esi=00150000 edi=feeefee6\neip=7c87c9e1 esp=0012f244 ebp=0012f298 iopl=0         nv up ei pl zr na po nc\ncs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246\nntdll!RtlDebugFreeHeap+0x82:\n7c87c9e1 0fb707           movzx   eax,word ptr [edi]    ds:0023:feeefee6=????\n0:000> k\nChildEBP RetAddr\n0012f298 7c85567a ntdll!RtlDebugFreeHeap+0x82\n0012f370 7c83e448 ntdll!RtlFreeHeapSlowly+0x37\n0012f454 73c37fb4 ntdll!RtlFreeHeap+0x11a\n0012f468 73c34a77 T2EMBED!T2free+0x1d\n0012f86c 31dbbb54 T2EMBED!TTDeleteEmbeddedFont+0x7c\n0012f884 31dbbae9 wwlib!DllCanUnloadNow+0x25fbcb\n0012f8ec 313406d8 wwlib!DllCanUnloadNow+0x25fb60\n0012f92c 3135944d wwlib!FMain+0xfc129\n0012f950 3135926c wwlib!FMain+0x114e9e\n0012f95c 31359231 wwlib!FMain+0x114cbd\n0012f984 31244c5b wwlib!FMain+0x114c82\n0012ff10 300015fb wwlib!FMain+0x6ac\n0012ff30 3000156d winword+0x15fb\n0012ffc0 77e6f32b winword+0x156d\n0012fff0 00000000 kernel32!BaseProcessStart+0x23\n\nNotes:\n\n- Reproduces on Windows Server 2003 (as an access violation) and\nWindows 7 (as a heap critical error)\n- Opening the document causes “Word experienced an error trying to\nopen the file.” dialog. After closing the dialog, and then closing\nWord, the crash occurs.\n- The dereference of the “heap free checking constant” suggests \nuse-after-free.\n- Analysis shows the third argument of RtlpDebugPageHeapFree is\n0xfeeefeee - this suggests that a pointer from a previously freed\nchunk is itself being freed.\n- The callstack may suggest a misuse of the font embedding API. For\nexample, this could be caused by multiple calls to\nTTDeleteEmbeddedFont using the same font reference handle.\n- Breakpointing the TTDeleteEmbeddedFont and recording the handle\nargument confirms that a font reference handle is deleted twice.\n- The test case reduces to a 1-bit difference from the original sample document.\n- The affected bit is in the lcbSttbfBkmkArto field of the\nFibRgFcLcb2007 (or FIBTable2007) structure.\n- Attached samples: 9adcab7c_1_crash.doc (crashing file),\n9adcab7c_1_orig.doc (original file)\n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse\nwithout a broadly available patch, then the bug report will automatically\nbecome visible to the public.\n\n```\n\n-----\nOriginal issue reported on code.google.com by `haw...@google.com` on 15 Sep 2014 at 11:10\n\nAttachments:\n* [9adcab7c_1_crash.doc](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-107/comment-0/9adcab7c_1_crash.doc)\n* [9adcab7c_1_orig.doc](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-107/comment-0/9adcab7c_1_orig.doc)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76006081","html_url":"https://github.com/chrsmith/google-security-research/issues/107#issuecomment-76006081","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/107","id":76006081,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:14:53Z","updated_at":"2015-02-25T17:14:53Z","body":"\n\n-----\nOriginal comment by `haw...@google.com` on 19 Nov 2014 at 8:01\n* Added labels: **CVE-2014-6333**"}}