Report description

apply_stch uint32 accumulation OOB write (Chromium renderer SEGV)

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

https://chromium.googlesource.com/chromium/src/third_party/+/refs/heads/main

The problem

Please describe the technical details of the vulnerability

• Upstream advisory: https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-5xrh-8c3h-7c49
• Upstream fix PR: https://github.com/harfbuzz/harfbuzz/pull/5929

Summary

In HarfBuzz apply_stch (src/hb-ot-shaper-arabic.cc), the MEASURE pass accumulates extra_glyphs_needed (uint32) across multiple STCH groups in one buffer. The overflow-detected break exits only the inner per-group loop; the outer step loop continues to CUT, which walks all groups and writes the full (non-wrapped) number of entries into a buffer sized by the partial pre-overflow value. Result: heap OOB write.

Chromium is reachable because Blink feeds an entire Arabic script run to hb_shape() with no fragment cap (Firefox has MAX_SHAPING_LENGTH=32760).

Repro

Artifacts (this directory):

• stch_of3.ttf – 844 B crafted font; stch → beh → [tile_f, tile_r]
• poc.html – @font-face loads the font, lays out 16,909,322 × BEH ALEF pairs in one RTL run.

Serve and point an ASan Chromium at the page:

python3 -m http.server 8899 &
ASAN_OPTIONS="log_path=/tmp/asan.log:handle_segv=1:allow_user_segv_handler=0:detect_leaks=0:symbolize=1" \
  ~/asan/asan-chromium/content_shell --no-sandbox --disable-hang-monitor \
  http://127.0.0.1:8899/poc.html

# takes 10-60s

Renderer SEGVs after page load; ASan log at /tmp/asan.log.<pid>.

Root cause

src/hb-ot-shaper-arabic.cc MEASURE block (pre-fix):

if (unlikely (hb_unsigned_mul_overflows (n_copies, n_repeating, &added_glyphs) ||
              hb_unsigned_add_overflows (extra_glyphs_needed, added_glyphs,
                                         &extra_glyphs_needed)))
  break;            // exits inner loop only

After the break, the outer if (step == MEASURE) { buffer->ensure (…); } uses the partial extra_glyphs_needed → small allocation → CUT OOB.

Credit

Matej Smycka

Impact analysis

Any website the victim visits can trigger this bug by serving a crafted font and some Arabic text. It reliably crashes the renderer tab on 64bit as the write lands far outside the process memory. 32bit would land into the process. The 64bit is unlikely to be exploited as controlled write, however it may be possible.

The cause

What version of Chrome have you found the security issue in?

148.0.7750.0 [ASan content_shell, Linux x86_64]

Is the security issue related to a crash?

No, it is not related to a crash.

Choose the type of vulnerability

Memory Corruption (in a sandboxed process)

How would you like to be publicly acknowledged for your report?

Matej Smycka