Stack buffer overflow in BDF file parsing

[Louis Simard]

Binary package hint: fontforge

[Description taken from Red Hat bug [3]]

Ulrik Persson reported a stack-based buffer overflow
flaw in the way FontForge font editor processed certain
Bitmap Distribution Format (BDF) font files, with
specially-crafted value of the CHARSET_REGISTRY header.
A remote attacker could create a specially-crafted BDF
font file and trick a local, unsuspecting user into
opening it in FontForge, which could lead to fontforge
executable crash or, potentially, arbitrary code execution
with the privileges of the user running the executable.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605537

Public PoC:
[2]
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=fontforge-overflow.txt;att=1;bug=605537

[3] Red Hat bug: https://bugzilla.redhat.com/show_bug.cgi?id=659359

Flaw severity note:
On systems with compile time buffer checks (FORTIFY_SOURCE)
feature enabled, the impact of this flaw is mitigated to
be only crash.

[Louis Simard (louis-simard-deactivatedaccount)]

Attached is a unified format patch which should copy strings correctly within
their allocated buffers, for many fields in the BDF file format, including
CHARSET_REGISTRY.

I have tested FontForge before and after the patch; it does not crash
predictably anymore.

[Louis Simard (louis-simard-deactivatedaccount)]

FontForge in Natty, Maverick and Lucid are affected by this vulnerability.

Since the package is compiled with stack smashing detection enabled, it may not be exploitable for arbitrary code execution via this vulnerability.

[Jamie Strandboge (jdstrand)]

This was fixed in 0.0.20100501-4ubuntu1.