[Webkit-unassigned] [Bug 75526] New: Potential heap overflow in the function named "drawTextWithSpacing" of wxCode

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=75526

           Summary: Potential heap overflow in the function named
                    "drawTextWithSpacing" of wxCode
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows XP
            Status: UNCONFIRMED
          Severity: Trivial
          Priority: P2
         Component: WebKit wx
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: showerduck at hotmail.com


Created an attachment (id=121067)
 --> (https://bugs.webkit.org/attachment.cgi?id=121067&action=review)
cpp file amended the potential heap overflow

Overview: 
There is a heap overflow in  the source code of "Source\WebCore\platform\wx\wxcode\gdiplus\non-kerned-drawing.cpp". It happens in the function named :
void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData* font, const wxColour& color, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point)

The overflow is obvious and may lead to the crash of wxWebkit module under the Windows. Problem codes listed as follow:
    int* spacing = new int[numGlyphs - from];  // I just don't know why [numGlyphs] subtracts [from] here....I think it should be"int* spacing = new int[numGlyphs]; " instead.
    for (unsigned i = 0; i < numGlyphs; ++i)
        spacing[i] = advances[i].width();    // <======= The subtraction results that spacing is not big enough to store all the width values if [from] is greater than Zero. Heap overflow happens here.

Steps to Reproduce: 
  review the source code....

Actual Results: 
  potential heap overflow

Expected Results: 
  .........................

Build Date & Platform: 
  .........................

Additional Builds and Platforms: 
  .........................

Additional Information: 
  .........................

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.