T1 Font Integer Overflow

The T1 Font Integer Overflow (a.k.a DejaVu as it is very similar to the Malformed CFF Vulnerability) is an exploit used in Saffron.

Credit

 * comex

Description
When dealing with op_callothersubr, arg_cnt is defined as an integer. arg_cnt is read from decoder&#8209;>stack, which could be set to  by charstring "fb ef". And this will bypass stack checking. Then "top &#8209;= arg_cnt" will make top point to data outside of decoder&#8209;>stack. Actually it points to decoder&#8209;>parse_callback. decoder&#8209;>parse_callback address minus default address of that function to get ASLR offset. That's how it bypasses ASLR.

This vulnerability was actually addressed by Apple in OS X v10.6.8 (Security Update 2011-004), but a fix was never pushed to iOS. (CVE-2011-0202).

When Apple released iOS 4.2.9/4.3.4 to patch this vulnerability, it received a different CVE identifier (CVE-2011-0226).