CVE-2020-56002: Heap Buffer Overflow in libxfont PCF Font Handler

Vulnerability Overview Vulnerability Name: pcftread: validate bitmap sizes and offsets against per-glyph metrics Vulnerability Description: The function directly reads data from the PCF file into to allocate a repainted bitmap buffer. However, the per-glyph metrics (also read from the file) control how much data writes. A malicious PCF font can declare a small value while using larger per-glyph metrics in practice, leading to a heap buffer overflow. A similar issue exists with encoding offsets: reads encoding offsets from the PCF file and uses them to index into the encoding table array without performing bounds checking. A malicious font can set encoding offsets greater than the metrics, resulting in out-of-bounds pointers when accessing glyphs via the encoding table. For the non-repainted bitmap path (when matches the requested glyph width), only the glyph offset is validated to ensure it is within the bitmap buffer, but the full glyph extent ( ) is not checked for buffer fit. A malicious font can set large glyph offsets near the end of a small bitmap buffer, causing a heap buffer overflow when the glyph is rendered. Impact This vulnerability affects applications using the function to handle PCF fonts. Malicious PCF fonts can exploit this vulnerability to cause a heap buffer overflow, potentially leading to remote code execution or denial of service attacks. Remediation Add bounds checking for and encoding offsets within the function to ensure they are consistent with per-glyph metrics. Validate that the full glyph extent ( ) fits within the buffer to prevent heap buffer overflows. Proof of Concept (PoC) / Exploit Code No specific PoC code or exploit code is provided in the page. Additional Information CVE ID: CVE-2020-56002/ZDI-CAN-30559 Discoverer: Anonymous individual in collaboration with the Trend Micro Zero Day Initiative Helper: Claude Signer: Peter Hutterer Partially from:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-56002: Heap Buffer Overflow in libxfont PCF Font Handler

More from this source