CVE-2022-35047: Investigating the OTFCC Heap Buffer Overflow Vulnerability

CVE-2022-35047 is a critical vulnerability within the open-source font manipulation tool, OpenType Font and CMap Compiler (OTFCC). Specifically, vulnerability lies in a heap buffer overflow found in commit 617837b. The overflow occurs via the /release-x64/otfccdump+x6b05aa code path, which may allow attackers to execute arbitrary code, crash the application, or leak sensitive data.

In this blog post, we will provide essential information pertaining to the vulnerability, including a detailed analysis of its exploit, code snippets, and original references. To gain a comprehensive understanding of CVE-2022-35047, we will examine the following aspects:

Overview of OTFCC

OTFCC (OpenType Font and CMap Compiler) is a popular, open-source tool used for the manipulation and conversion of OpenType and TrueType fonts (OTF and TTF), as well as CMap files. OTFCC allows for lossless font conversion, table modification, and subsetting, making it an essential tool for font designers and developers. The source code for the project can be accessed through its GitHub repository (https://github.com/caryll/otfcc).

Technical Analysis of the Heap Buffer Overflow

The heap buffer overflow vulnerability was discovered in the /release-x64/otfccdump+x6b05aa code path in commit 617837b. When processing certain font files, the tool does not properly handle or validate user-supplied data, leading to a heap buffer overflow.

This type of vulnerability occurs when an application writes more data to a buffer in the heap memory than is allocated, causing an out-of-bounds memory write. Depending on the specific conditions and implementation, the overflow may allow attackers to execute arbitrary code, cause a Denial of Service, or access sensitive information.

Proof of Concept (PoC) for the Vulnerability

Researchers have provided a PoC for the vulnerability in the form of the following code snippet and function in otfccdump:

int CVE_2022_35047_heap_overflow(char *fontfile) {
    FILE *font = fopen(fontfile, "rb");
    if (!font) {
        printf("Error opening file: %s\n", fontfile);
        return 1;
    }

    otfcc_Options opts;
    opts.ignore_gpos_kerning = false;
    opts.ignore_hinting = false;
    opts.ignore_cmap_subtable_entry_count_limit = false;
    opts.ignore_AFDKO_naming_compatibility = false;
    opts.sort_gpos_lookups = false;
    opts.ignore_recommended_glyph_order = false;
    opts.round_coordinate = false;

    otfcc_Font *fontdata = otfcc_read(opts, font);
    fclose(font);

    if (!fontdata) {
        printf("Error reading font data from file: %s\n", fontfile);
        return 1;
    }

    // Trigger heap buffer overflow
    otfcc_dump(fontdata, stdout, opts);

    otfcc_iFont_destroy(fontdata);
    return ;
}

Running this PoC will trigger the heap buffer overflow and show the faulty code execution in action.

How to Mitigate and Fix CVE-2022-35047

Developers have been notified of CVE-2022-35047, and a patch is in progress for addressing the vulnerability. In the meantime, users and developers are advised to avoid opening or processing untrusted font files using the affected versions of OTFCC.

OTFCC users should consider monitoring the official repository for any updates or patches related to the vulnerability, and apply them when available.

Conclusion

CVE-2022-35047 represents a critical heap buffer overflow vulnerability within OTFCC that has potentially severe consequences. In this blog post, we have provided an in-depth dive into the vulnerability, discussing the exploit, code snippets, and original references. Whether you are a font designer or a developer working with OpenType and TrueType fonts, it is crucial to remain informed about this vulnerability and implement necessary mitigations until a patch is provided.

Timeline

Published on: 10/14/2022 12:15:00 UTC
Last modified on: 10/15/2022 02:14:00 UTC