CVE-2024-7534

October 13, 2024

CVE Details

Google Chrome

August 5, 2024 – Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Chromium security severity: High

Credit: Tashita Software Security
Researcher: Javier

CVE Mitre
Chrome Release Notes
Chromium Issue 352467338

Vulnerability Details

Bug

Heap buffer overflow in Blink Layout.

Backtrace

==1346450==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50200004eed8 at pc 0x5601ea0c8365 bp 0x7ffe66315430 sp 0x7ffe66315428
READ of size 4 at 0x50200004eed8 thread T0 (chrome)
    #0 0x5601ea0c8364 in blink::LogicalLineBuilder::BidiReorder(blink::TextDirection, blink::LogicalLineItems*, blink::HeapVector<cppgc::internal::BasicMember<blink::LogicalRubyColumn, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>&) third_party/blink/renderer/core/layout/inline/logical_line_builder.cc:644:29
    #1 0x5601ea0c5249 in blink::LogicalLineBuilder::CreateLine(blink::LineInfo*, blink::LogicalLineItems*, blink::InlineLayoutAlgorithm*) third_party/blink/renderer/core/layout/inline/logical_line_builder.cc:84:5
    #2 0x5601e9dc48ca in blink::InlineLayoutAlgorithm::CreateLine(blink::LineLayoutOpportunity const&, blink::LineInfo*, blink::LogicalLineContainer*) third_party/blink/renderer/core/layout/inline/inline_layout_algorithm.cc:381:16
    #3 0x5601e9dce5e0 in blink::InlineLayoutAlgorithm::Layout() third_party/blink/renderer/core/layout/inline/inline_layout_algorithm.cc:1242:5

Testcase

Advisories

CVE-2024-7534

October 13, 2024

CVE Details

Google Chrome

August 5, 2024 – Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Chromium security severity: High

Credit: Tashita Software Security
Researcher: Javier

CVE Mitre
Chrome Release Notes
Chromium Issue 352467338

Vulnerability Details

Bug

Heap buffer overflow in Blink Layout.

Backtrace

==1346450==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50200004eed8 at pc 0x5601ea0c8365 bp 0x7ffe66315430 sp 0x7ffe66315428
READ of size 4 at 0x50200004eed8 thread T0 (chrome)
    #0 0x5601ea0c8364 in blink::LogicalLineBuilder::BidiReorder(blink::TextDirection, blink::LogicalLineItems*, blink::HeapVector<cppgc::internal::BasicMember<blink::LogicalRubyColumn, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>&) third_party/blink/renderer/core/layout/inline/logical_line_builder.cc:644:29
    #1 0x5601ea0c5249 in blink::LogicalLineBuilder::CreateLine(blink::LineInfo*, blink::LogicalLineItems*, blink::InlineLayoutAlgorithm*) third_party/blink/renderer/core/layout/inline/logical_line_builder.cc:84:5
    #2 0x5601e9dc48ca in blink::InlineLayoutAlgorithm::CreateLine(blink::LineLayoutOpportunity const&, blink::LineInfo*, blink::LogicalLineContainer*) third_party/blink/renderer/core/layout/inline/inline_layout_algorithm.cc:381:16
    #3 0x5601e9dce5e0 in blink::InlineLayoutAlgorithm::Layout() third_party/blink/renderer/core/layout/inline/inline_layout_algorithm.cc:1242:5