CVE-2015-0823 (published 2015-02-25T11:59Z)

Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/khaledhosny/ots
commit_details: repo_url: https://github.com/khaledhosny/ots
author: Khaled Hosny
author_date: 2014-11-15 04:29:36+02:00
msg: [ots] Fix (potential) use-after-free bugs

Make sure we don’t try to access the table after deleting it. Not all
the changed files are affected, but I changed them all for the sake of
consistency.
repository: repo_url: https://github.com/khaledhosny/ots
repo_name: khaledhosny/ots
description: Sanitizer for OpenType
repo_language: C++
owner: khaledhosny
file_changes: filename: gasp.cc
change_type: ModificationType.MODIFY
diff: @@ -11,10 +11,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->gasp; \
-    file->gasp = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->gasp; \
+    file->gasp = 0; \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: gdef.cc
change_type: ModificationType.MODIFY
diff: @@ -231,9 +231,9 @@ bool ParseMarkGlyphSetsDefTable(ots::OpenTypeFile *file, const uint8_t *data,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gdef->data = 0; \
     file->gdef->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: gpos.cc
change_type: ModificationType.MODIFY
diff: @@ -677,9 +677,9 @@ bool ParseExtensionPositioning(const ots::OpenTypeFile *file,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gpos->data = 0; \
     file->gpos->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: gsub.cc
change_type: ModificationType.MODIFY
diff: @@ -530,9 +530,9 @@ bool ParseReverseChainingContextSingleSubstitution(
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gsub->data = 0; \
     file->gsub->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: hdmx.cc
change_type: ModificationType.MODIFY
diff: @@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->hdmx; \
-    file->hdmx = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->hdmx; \
+    file->hdmx = 0; \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: kern.cc
change_type: ModificationType.MODIFY
diff: @@ -11,9 +11,9 @@
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     delete file->kern; \
     file->kern = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: ltsh.cc
change_type: ModificationType.MODIFY
diff: @@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->ltsh; \
-    file->ltsh = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->ltsh; \
+    file->ltsh = 0; \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: math.cc
change_type: ModificationType.MODIFY
diff: @@ -518,9 +518,9 @@ bool ParseMathVariantsTable(const ots::OpenTypeFile *file,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->math->data = 0; \
     file->math->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: vdmx.cc
change_type: ModificationType.MODIFY
diff: @@ -11,10 +11,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->vdmx; \
-    file->vdmx = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->vdmx; \
+    file->vdmx = 0; \
   } while (0)
 
 namespace ots {

programming_language: C++
filename: vorg.cc
change_type: ModificationType.MODIFY
diff: @@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->vorg; \
-    file->vorg = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->vorg; \
+    file->vorg = 0; \
   } while (0)
 
 namespace ots {

programming_language: C++