Avoid crashes when decoding woff2 fonts on alignment critical architectures

4 files changed, 72 insertions, 3 deletions

diff --git a/www/firefox/Makefile b/www/firefox/Makefile
index 41da16ffc4e..ec8f2f5e3f3 100644
--- a/www/firefox/Makefile
+++ b/www/firefox/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.273 2016/12/04 05:17:43 ryoon Exp $
+# $NetBSD: Makefile,v 1.274 2016/12/09 11:51:09 martin Exp $
 
 FIREFOX_VER=		${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
 MOZ_BRANCH=		50.0
@@ -6,7 +6,7 @@ MOZ_BRANCH_MINOR=	.2
 
 DISTNAME=	firefox-${FIREFOX_VER}.source
 PKGNAME=	firefox-${MOZ_BRANCH}${MOZ_BRANCH_MINOR:S/b/beta/:S/esr//}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	www
 MASTER_SITES+=	${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+=	${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
diff --git a/www/firefox/distinfo b/www/firefox/distinfo
index 4d3c300f2de..73867254ebb 100644
--- a/www/firefox/distinfo
+++ b/www/firefox/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.263 2016/12/05 11:54:45 martin Exp $
+$NetBSD: distinfo,v 1.264 2016/12/09 11:51:09 martin Exp $
 
 SHA1 (firefox-50.0.2.source.tar.xz) = 083b9a803b25064b2d7d43e289797a9f2a2e9e5d
 RMD160 (firefox-50.0.2.source.tar.xz) = 67395703c955b3285237b66317df13229aeec479
@@ -105,6 +105,8 @@ SHA1 (patch-mobile_android_installer_Makefile.in) = fcf4ab03ab033f8637813e30b75a
 SHA1 (patch-mobile_android_installer_package-manifest.in) = e978af41ff0c4b5e477bd3387594e238dc2ec224
 SHA1 (patch-modules_libjar_nsZipArchive.cpp) = 133b1658839d9b0f932a601670862c1f4cd70881
 SHA1 (patch-modules_libpref_init_all.js) = 3bc5962fdabb5aecb72ffc7e73bb56392d1ea717
+SHA1 (patch-modules_woff2_src_store_bytes.h) = f7081a6ffadc79e19f30137ca805b962e60821e8
+SHA1 (patch-modules_woff2_src_woff2_common.cc) = 77dec15dad41d47a3f85e578587c3a137a8dc7f3
 SHA1 (patch-moz.configure) = cd4d3851e9dc2c1adb6a92b6f3cd1966adcd5beb
 SHA1 (patch-mozglue_build_arm.cpp) = f41ace63b3f1d2a8ccaffc98c3c64d1e22af5249
 SHA1 (patch-mozglue_build_arm.h) = 5e272f4e19b9681d43a63c45d78b0e44a392c7dc
diff --git a/www/firefox/patches/patch-modules_woff2_src_store_bytes.h b/www/firefox/patches/patch-modules_woff2_src_store_bytes.h
new file mode 100644
index 00000000000..4309a2d44ca
--- /dev/null
+++ b/www/firefox/patches/patch-modules_woff2_src_store_bytes.h
@@ -0,0 +1,41 @@
+$NetBSD: patch-modules_woff2_src_store_bytes.h,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Avoid unaligned access, use memcpy instead of dereferencing
+a casted pointer.
+
+Firefox bug report:
+	https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/store_bytes.h.orig	2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/store_bytes.h	2016-12-09 12:09:13.632981168 +0100
+@@ -34,10 +34,11 @@
+ 
+ inline size_t Store16(uint8_t* dst, size_t offset, int x) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) =
+-      ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  uint16_t v = ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  memcpy(dst + offset, &v, 2);
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) = static_cast<uint16_t>(x);
++  uint16_t v = static_cast<uint16_t>(x);
++  memcpy(dst + offset, &v, 2);
+ #else
+   dst[offset] = x >> 8;
+   dst[offset + 1] = x;
+@@ -54,11 +55,13 @@
+ 
+ inline void Store16(int val, size_t* offset, uint8_t* dst) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) =
++  uint16_t v = ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
++  memcpy(dst + *offset, &v, 2);
+       ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
+   *offset += 2;
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) = static_cast<uint16_t>(val);
++  uint16_t v = static_cast<uint16_t>(val);
++  memcpy(dst + *offset, &v, 2);
+   *offset += 2;
+ #else
+   dst[(*offset)++] = val >> 8;
diff --git a/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc b/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc
new file mode 100644
index 00000000000..448b6430045
--- /dev/null
+++ b/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc
@@ -0,0 +1,26 @@
+$NetBSD: patch-modules_woff2_src_woff2_common.cc,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Use memcpy instead of dereferencing a pointer after casting it
+to a type needing greater alignement on some architectures.
+
+Firefox bug report:
+	https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/woff2_common.cc.orig	2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/woff2_common.cc	2016-12-09 09:33:50.193846136 +0100
+@@ -25,12 +25,13 @@
+   uint32_t checksum = 0;
+   size_t aligned_size = size & ~3;
+   for (size_t i = 0; i < aligned_size; i += 4) {
++    uint32_t v;
++    memcpy(&v, buf + i, 4);
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-    uint32_t v = *reinterpret_cast<const uint32_t*>(buf + i);
+     checksum += (((v & 0xFF) << 24) | ((v & 0xFF00) << 8) |
+       ((v & 0xFF0000) >> 8) | ((v & 0xFF000000) >> 24));
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-    checksum += *reinterpret_cast<const uint32_t*>(buf + i);
++    checksum += v;
+ #else
+     checksum += (buf[i] << 24) | (buf[i + 1] << 16) |
+       (buf[i + 2] << 8) | buf[i + 3];