Heap-buffer-overflow reads in the GSUB/GPOS byte-swap pass on malformed fonts

Open

dimenusopened 18d ago

Tested with commit cc63806 (v2.28e), Apple clang 21, macOS arm64, -fsanitize=address,undefined.

Two malformed fonts from HarfBuzz's test suite make kbts_FontFromMemory read past the end of its buffer while it byte-swaps GSUB/GPOS lookups. HarfBuzz uses them in test/shape/data/in-house/tests/context-matching.tests, where it only checks that nothing crashes.

// cc -g -fsanitize=address,undefined load_font.c -o load_font && ./load_font font.ttf
#define KB_TEXT_SHAPE_IMPLEMENTATION
#include "kb_text_shape.h"
#include "common.h"

int main(int argc, char **argv)
{
    int size;
    void *data = read_file(argv[1], &size);
    kbts_font font = kbts_FontFromMemory(data, size, 0, 0, 0);
    printf("kbts_FontIsValid: %d\n", kbts_FontIsValid(&font));
    return 0;
}

36f8e7f3…: a read 1 byte past the end of the blob buffer:

==ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 2 thread T0
    #0 kbts__UnpackValueRecord kb_text_shape.h:15441
    #1 kbts__ByteSwapValueRecord kb_text_shape.h:16502
    #2 kbts__ByteSwapGposLookupSubtable kb_text_shape.h:17706
    #3 kbts_PlaceBlob kb_text_shape.h:28627
    #4 kbts_FontFromMemory kb_text_shape.h:29190
0x00010a926569 is located 1 bytes after 4676968-byte region

ecc344a5…: the bounds check in kbts__ByteSwapArray16 overflows first. I think the count is Rule->GlyphCount - 1 + ... with GlyphCount == 0 (from kbts__ByteSwapSequenceContextSubtable, line 16903), so Array + Count wraps and <= End passes. Then the read goes past the end:

kb_text_shape.h:14207:21: runtime error: addition of unsigned offset to 0x00010a52e0da overflowed to 0x00010a52e0d8
==ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 2 thread T0
    #1 kbts__ReadU16Unaligned kb_text_shape.h:14168
    #2 kbts__ByteSwapArray16Unchecked kb_text_shape.h:14199
    #3 kbts__ByteSwapArray16 kb_text_shape.h:14209
    #4 kbts__ByteSwapArray16Context kb_text_shape.h:16106
0x00010a7dd7fc is located 0 bytes after 2854908-byte region

The byte-swap pass also writes, so these may be out-of-bounds writes too. ASan stops at the first read.

I know the header says not to use kb on untrusted fonts. I'm filing this because I would like to use kb for fonts embedded in PDF files, and HarfBuzz's fuzz fonts are an easy way to test this path.

(I found this with help from Claude, with a harness that runs HarfBuzz's shaping test suite through kb and through HarfBuzz and compares them. I checked each repro by hand.)

Activity

No activity yet.