FontForge Memory Leak Vulnerability in utf7toutf8_copy Function

A memory leak vulnerability has been identified in FontForge versions through 20230101. The issue arises in the utf7toutf8_copy function, leading to a denial-of-service condition by causing unnecessary memory consumption.

Impact

Exploitation of this vulnerability causes a memory leak, which can lead to increased memory usage and potential denial-of-service conditions.

Reproduction

The vulnerability can be reproduced by compiling FontForge with leak sanitization enabled, using specific compiler flags. After compiling and installing the application, the memory leak can be triggered by executing FontForge with a command that opens a specially crafted file, which can be referenced as 'poc_file'.

Remediation

Users can upgrade to the latest version of FontForge, where this vulnerability has been fixed.