The gfxOTSExpandingMemoryStream allocated its initial buffer via mAlloc.Grow(nullptr, mLength) and grew it via mAlloc.Grow(mPtr, newLength) in the write path, but neither call zeroed the freshly obtained bytes. Because an ots::OTSStream supports seeking (Seek) and writing at arbitrary offsets, a sanitized font can legitimately leave gaps between written table regions, and the buffer’s logical length can exceed the sum of bytes actually written. The violated invariant is that every byte of the stream buffer that becomes part of the emitted font must have a defined value; instead, unwritten gaps and any tail slack retained stale heap contents left over from previous allocations.

The fix restores the invariant by std::memset-ing the newly allocated region to zero — the whole initial block in the constructor and only the newly added [mLength, newLength) span on each grow — so any byte not subsequently overwritten by real font data reads back as zero. This closes the leak while avoiding redundant re-zeroing of already-initialized bytes on each growth.

An attacker gains disclosure of uninitialized heap memory from the content/graphics process that performs font sanitization, potentially exposing pointers or secret data useful for defeating ASLR or building further exploits. The precondition is only that the victim loads an attacker-controlled web font, which any visited web page can request. No memory corruption or code execution follows directly from this diff; the demonstrated impact is information disclosure.