Talos Vulnerability Report

TALOS-2016-0061

Libgraphite LocaLookup Denial of Service Vulnerability

February 5, 2016

CVE Number

CVE-2016-1521

Description

An exploitable denial of service vulnerability exists in the font handling of Libgraphite. A specially crafted font can cause an out-of-bounds read potentially resulting in an information leak or denial of service. An attacker can provide a malicious font to trigger this vulnerability.

Tested Versions

Libgraphite 2-1.2.4

Product URLs

<http://sourceforge.net/projects/silgraphite/files/graphite2/&gt;

Details

When reading an invalid font where the loca table size is set to 0 an out of bounds read will occur.

At line 187 in GlyphCache.cpp, the function Loader is defined which loads a number of tables from the font, including the loca table. At line 206 it will then call the function TtfUtil:LocaLookup with arguments that provide the number of glyphs, the local table and its size:

if (TtfUtil::LocaLookup(numglyphsgraphics-1, _loca, _loca.size(), _head) == sizet(-1))

At line 1164 in this function (in file TtfUtil.cpp), the loca table will be accessed using the number of glyphs:

return be::peek(pLongTable + nGlyphId);

A size check is performed at line 1161, but since the size is set to 0, this will always pass.

if (nGlyphId < (lLocaSize >> 2) - 1)

This will read out of the bounds of the table by an arbitrary 16-byte number, which will cause a denial of service and could potentially lead to an information leak.

The malicious font provided here can be used to generate the problem by using the ‘simple’ test program provided with libgraphite and the parameter ‘test’: ./simple maliciousfont test

Credit

Yves Younan

---

Vulnerability Reports Next Report

TALOS-2016-0026

Previous Report

TALOS-2016-0060