CyberRota Analysis
AI-GeneratedThe vulnerability exists in the libXfont2 font-server client, where improper validation between the number of character encodings and the allocated size of the array can lead to out-of-bounds heap reads and writes. This critical flaw allows a malicious font server to exploit the discrepancy, potentially leading to arbitrary code execution or data corruption. Organizations utilizing libXfont2 in their systems should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.