oCERT-2009-001 Pango integer overflow in heap allocation size calculations
Pango is a library for laying out and rendering text, with an emphasis on internationalization. Pango suffers from a multiplicative integer overflow which may lead to a potentially exploitable, heap overflow depending on the calling conditions. For example, this vulnerability is remotely reachable in Firefox by creating an overly large document.location value but only results in a process-terminating, allocation error (denial of service).
The affected function is pango_glyph_string_set_size. An overflow check when doubling the size neglects the overflow possible on the subsequent allocation:
string->glyphs = g_realloc (string->glyphs, string->space * sizeof (PangoGlyphInfo));
Note that other font rendering subsystems suffer from similar issues and should be cross-checked by maintainers.
Pango < 1.24
(check with your ѕpecific package maintainer for backports)
Pango >= 1.24
Credit: Will Drewry, oCERT Team | Google Security Team. Special thanks to Karl Tomlinson for extended analysis of the impact on Firefox.
2009-02-22: attempted to contact upstream via gtk-i18n-list AT gnome.org
2009-02-25: bug filed with Mozilla against firefox
2009-03-02: Behdad Esfahbod patched Pango upstream (for 1.24)
2009-04-13: vendor-sec alerted regarding backporting the silent pango fix
2009-04-23: embargo date and CVE assigned (thanks Josh Bressers!)
2009-05-07: advisory release