[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<SA1PR15MB4840CBCB4D36E36C85723862DAD32@SA1PR15MB4840.namprd15.prod.outlook.com>
Date: Thu, 13 Mar 2025 20:50:19 +0000
From: Vulnerability Disclosure <vulns@...a.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0
In the following change
+ if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
+ FT_QNEW_ARRAY( outline.tags, limit ) ||
+ FT_QNEW_ARRAY( outline.contours, limit ) ||
+ FT_QNEW_ARRAY( unrounded, limit + 4 ) )
The out of bounds write requires a short integer overflow with a limit value of 0xFFFD - 0xFFFF. In the patch when we change the second call to FT_QNEW_ARRAY to remove the addition of +4 the size value is now negative and the call to FT_QNEW_ARRAY call will fail with an error code causing the logic to short circuit and prevent the out of bounds write from occurring. While limit is still signed the security risk is mitigated by the early exit condition.
If we also want to make the limit variable unsigned, we can additionally patch based off the following FreeType commit:
https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
