Penetration Test Report (RadicallyOpenSecurity): 2017 CodeReview Graphite font system v1.0

Confidential
PENETRATION TEST REPORT
for
Secure Open Source (Mozilla)
V1.0
Amsterdam
November 9th, 2017
1/32
Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
Document Properties
Client Secure Open Source (Mozilla)
Title PENETRATION TEST REPORT
Target Graphite font system
Version 1.0
Pentesters Stefan Marsiske, Pierre Pronchery
Authors Stefan Marsiske, Pierre Pronchery, Marcus Bointon
Reviewed by Marcus Bointon
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 October 12th, 2017 Stefan Marsiske Initial draft
0.2 October 20th, 2017 Pierre Pronchery Imported more findings
0.3 November 7th, 2017 Marcus Bointon Review
1.0 November 9th, 2017 Marcus Bointon Final version
Contact
For more information about this Document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
2/32
Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
Table of Contents
1 Executive Summary ................................................................................................................................... 4
1.1 Introduction .............................................................................................................................................. 4
1.2 Scope of work ......................................................................................................................................... 4
1.3 Project objectives .................................................................................................................................... 4
1.4 Timeline ................................................................................................................................................... 4
1.5 Results In A Nutshell .............................................................................................................................. 4
1.6 Summary of Findings .............................................................................................................................. 5
1.6.1 Findings by Threat Level ..................................................................................................................... 7
1.6.2 Findings by Type .................................................................................................................................. 7
1.7 Summary of Recommendations .............................................................................................................. 7
2 Methodology ............................................................................................................................................... 9
2.1 Planning .................................................................................................................................................. 9
2.2 Risk Classification ................................................................................................................................... 9
3 Reconnaissance and Fingerprinting .......................................................................................................... 10
3.1 Automated Scans .................................................................................................................................... 10
4 Pentest Technical Summary ...................................................................................................................... 10
4.1 Findings ................................................................................................................................................... 10
4.1.1 MGR-001 — Potential Integer Overflow in Memory Allocator ............................................................. 10
4.1.2 MGR-002 — Graphite Builds With the Stack Protector Disabled ........................................................ 11
4.1.3 MGR-003 — Graphite/src/Segment.cpp Constructor Possible Null Pointer Dereference .................... 12
4.1.4 MGR-004 — Graphite/src/Pass.cpp CollisionShift NULL Pointer Dereference & Integer Overflow ..... 13
4.1.5 MGR-005 — Graphite/src/inc/List.h Possible Integer Overflow ........................................................... 14
4.1.6 MGR-006 — Graphite/src/inc/Rule.h Slotmap::operator[] Does Not Check Bounds ........................... 15
4.1.7 MGR-007 — Graphite/src/Font.cpp Font::Font() Division-related FPE ................................................ 15
4.1.8 MGR-008 — Graphite/src/Font.cpp M_advances NULL Pointer Dereferences ................................... 16
4.1.9 MGR-009 — Floating Point Exception in VM ...................................................................................... 17
4.1.10 MGR-010 — Possible NULL Pointer Dereference in ShiftCollider::mergeSlot() ................................ 18
4.1.11 MGR-011 — Potential Crash in FileFace::get_table_fn() ................................................................... 19
4.1.12 MGR-012 — Potential Use After Free When Logging ....................................................................... 19
4.1.13 MGR-013 — The LZ4 Parser Does Not Pass the Tests From Liblz4 ................................................ 20
4.1.14 MGR-014 — Incomplete Sanity Check When Looking up Glyphs .................................................... 22
4.1.15 MGR-015 — Graphite/src/inc/Compression.h::overrun_copy Integer Overflow Leads to
Uninitialized Buffer ......................................................................................................................................... 24
4.1.16 MGR-016 — Graphite/src/inc/Compression.h::overrun_copy Possible Buffer Overflow .................... 25
4.1.17 MGR-017 — Graphite/src/Segment.cpp linkClusters Null Pointer Dereference ................................ 25
4.1.18 MGR-018 — Graphite/src/inc/Sparse.h Sparse(x,y) Code Smell ...................................................... 26
4.1.19 MGR-019 — Graphite/src/inc/FeatureMap.h Possible NULL Pointer Dereference ........................... 27
4.1.20 MGR-020 — Graphite/src/Code.cpp Machine::Code::Code() Constructor Possible Memory Leak ... 28
4.1.21 MGR-021 — Graphite/src/inc/List.h Possible Integer/memory Overflow ........................................... 29
5 Future Work ............................................................................................................................................... 30
6 Conclusion .................................................................................................................................................. 31
Appendix 1 Testing team ............................................................................................................................. 32
3/32
Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
1 Executive Summary
1.1 Introduction
Between August 28, 2017 and October 12, 2017, Radically Open Security B.V. carried out a code audit for
Secure Open Source (Mozilla).
This report contains our findings as well as detailed explanations of exactly how ROS performed the code
audit.
1.2 Scope of work
The scope of the penetration test was limited to the following target:
• Graphite font system
Some parts of the source code that are not part of release builds (debugging or tracing code), or are
considered deprecated (ALL_TTFUTILS, GRAPHITE2_NSEGCACHE) were explicitly out of scope.
1.3 Project objectives
The objective of the project was to conduct a thorough code review, with particular focus on identifying issues
that might be difficult to find by fuzzing.
1.4 Timeline
The Security Audit took place between August and October 2017.
1.5 Results In A Nutshell
Of all the issues found and reported during this audit, only one was rated with an elevated severity, MGR-001
(page 10). It could only possibly be exploited in combination with another issue (allowing it to reach th