CVE-2020-50005: libfont14 computeProps Buffer Overflow Vulnerability

Vulnerability Overview A lack of bounds checking during writes to the property buffer in the function leads to a buffer overflow. Specifically, allocates a fixed-size property buffer with 70 slots. The function iterates over the source font's properties, writing 1 slot for unscaled properties or 2 slots for scaled properties, without performing any bounds checks. If a font contains numerous duplicate properties that match entries, it may exceed the allocated buffer. Impact Scope This vulnerability affects all scenarios using the function to process font properties. It is particularly critical when fonts contain a large number of duplicate properties, as this can lead to a buffer overflow, potentially resulting in further security vulnerabilities. Remediation The fix involves passing the remaining buffer capacity to and checking it before each write. Any properties that would exceed the buffer boundaries are silently skipped. Additionally, the function has been restructured to handle writes for scaled properties directly within the switch cases, rather than in a separate block after the switch statement. This clarifies the control flow and ensures that bounds checks cover all write operations. Code Block Additional Information CVE Number: CVE-2020-50005/ZDI-CAN-30508 Discoverer: Anonymous working with TrendAI Zero Day Initiative Assisted by: Claude Signer: Peter Hutterer Partial Source:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-50005: libfont14 computeProps Buffer Overflow Vulnerability