Bug 725760

libXfont contains a compress / LZW decompressor implementation.  This implementation does not correctly handle compressed streams that contain code words that were not yet added to the decompression table.  LZW decompression has a special case (a KwKwK string) when code word matches the first free entry in the decompression table.  The implementation used in libXfont allow code words not only matching, but also exceeding the first free entry.

Relevant code appears in BufCompressedFill() in src/fontfile/decompress.c:

        /*
         * Special case for KwKwK string.
         */
        if ( code >= file->free_ent ) {
            *stackp++ = finchar;
            code = oldcode;
        }

http://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/fontfile/decompress.c?id=f29f1d68d7eca96e45ba3758686be07993d82e03#n249

This allows creating a loop in the decompression table, which leads to an "infinite" loop:

        /*
         * Generate output characters in reverse order
         */
        while ( code >= 256 )
        {
            *stackp++ = file->tab_suffix[code];
            code = file->tab_prefix[code];
        }

http://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/fontfile/decompress.c?id=f29f1d68d7eca96e45ba3758686be07993d82e03#n257

and heap-based buffer overflow (CompressedFile's de_stack[]):

        char_type       de_stack[STACK_SIZE];
        char_type       *tab_suffix;
        unsigned short  *tab_prefix;
    } CompressedFile;

http://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/fontfile/decompress.c?id=f29f1d68d7eca96e45ba3758686be07993d82e03#n121


Once stackp is incremented to point to after de_stack[] buffer end, tab_suffix and tab_prefix pointers are corrupted, which may lead to arbitrary memory corruption.  libXfont is used by X server and can parse arbitrary user-supplied font file.  Successful exploitation may possibly lead to a local privilege escalation.