FontForge Memory Leak Vulnerability in DlgCreate8 Component

A memory leak vulnerability has been identified in FontForge versions through 20230101, specifically within the DlgCreate8 function. This leak was detected using LeakSanitizer, which reported a direct leak of 40 bytes from a single allocation. The issue arises when the software processes certain font files, leading to increased memory usage that is not properly released.

Impact

Exploitation of this vulnerability causes a memory leak, which can lead to a denial-of-service condition by exhausting available memory resources.

Reproduction

The vulnerability can be reproduced by compiling FontForge with AddressSanitizer and Undefined Behavior Sanitizer enabled, using AFL (American Fuzzy Lop) as the compiler. After compiling and installing the application, FontForge can be run with a command that opens a specific font file using the FontForge scripting language. This process triggers the memory leak in the DlgCreate8 function.

Remediation

Users can upgrade to the latest version of FontForge, where this vulnerability has been fixed.