search

xti9er / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Avast: integer overflow verifying numFonts in TTC Header #549

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
If the numFonts field in the TTC header is greater than (SIZE_MAX+1) / 4, an 
integer overflow occurs in filevirus_ttf() when calling 
CSafeGenFile::SafeLockBuffer.

The TTC file format is described here 
https://www.microsoft.com/typography/otspec/otff.htm

The attached testcase has password "infected".

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by tav...@google.com on 1 Oct 2015 at 4:20

Attachments:

GoogleCodeExporter commented 8 years ago 
This issue appears to be resolved.

Original comment by tav...@google.com on 9 Dec 2015 at 8:17