Bug 1777938 (CVE-2019-19308)

Summary: CVE-2019-19308 gnome-font-viewer: NULL pointer dereference in text_to_glyphs in sushi-font-widget.c
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: alexl, cosimo.cecchi, gnome-sig, tiagomatos
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A NULL pointer dereference was discovered in the gnome-font-viewer in the way it deals with fonts without a family name. A user may be tricked into opening a specially crafted font, which could make the gnome-font-viewer crash.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-01-14 14:09:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1777939    
Bug Blocks: 1777940    

Description Guilherme de Almeida Suckevicz 2019-11-28 18:06:24 UTC
In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).


Upstream commit:

Comment 1 Guilherme de Almeida Suckevicz 2019-11-28 18:06:34 UTC
Created gnome-font-viewer tracking bugs for this issue:

Affects: fedora-all [bug 1777939]

Comment 3 Riccardo Schirone 2020-01-14 10:20:13 UTC
While parsing a TTF font file without the name section, function build_strings_for_face() sets the font_name as the result of `g_strconcat(family_name, " ", style_name, NULL)`. Function g_strconcat() concatenates a variable number of arguments until a NULL is found. If the very first argument is NULL, the result is NULL as well. With a specially crafted TTF font file it is possible to make family_name NULL, thus resulting in a NULL font_name which cause a NULL pointer dereference in function text_to_glyphs(), when trying to compute the length of the font_name string.

Comment 4 Riccardo Schirone 2020-01-14 13:33:12 UTC
First vulnerable commit:

which was first introduced in upstream version 3.33.4.
This commit removes the NULL checks in sushi_font_widget_size_request() and build_strings_for_face() for family_name and font_name, assuming font_name will always be set. However, the commit does not handle the case where family_name is NULL, thus creating this vulnerability.

Comment 6 Riccardo Schirone 2020-01-14 13:39:06 UTC
This is barely a real security flaw as gnome-font-viewer is not a service, but just a short living program, which is not really impacted by a single crash that cannot be exploited, as a NULL dereference like this.

Comment 7 Riccardo Schirone 2020-01-14 13:39:33 UTC

This issue did not affect the versions of gnome-font-viewer as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable code.

Comment 8 Product Security DevOps Team 2020-01-14 14:09:37 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):