[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0e83fd0ed11d376814baaa98c1c3deed5ce50295.camel@michel-slm.name>
Date: Thu, 13 Mar 2025 21:54:43 -0500
From: Michel Lind <michel@...hel-slm.name>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-27363: out of bounds write in FreeType
<= 2.13.0
On Thu, 2025-03-13 at 20:50 +0000, Vulnerability Disclosure wrote:
> In the following change
>
> + if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
> + FT_QNEW_ARRAY( outline.tags, limit ) ||
> + FT_QNEW_ARRAY( outline.contours, limit ) ||
> + FT_QNEW_ARRAY( unrounded, limit + 4 ) )
>
> The out of bounds write requires a short integer overflow with a
> limit value of 0xFFFD - 0xFFFF. In the patch when we change the
> second call to FT_QNEW_ARRAY to remove the addition of +4 the size
> value is now negative and the call to FT_QNEW_ARRAY call will fail
> with an error code causing the logic to short circuit and prevent the
> out of bounds write from occurring. While limit is still signed the
> security risk is mitigated by the early exit condition.
>
> If we also want to make the limit variable unsigned, we can
> additionally patch based off the following FreeType commit:
>
> https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442
>
As a follow-up to that (sorry to keep trickling in information) - it
turns out a third commit is required
https://gitlab.freedesktop.org/freetype/freetype/-/commit/c71eb22dde1a3101891a865fdac20a6de814267d
FT_QNEW_ARRAY does not do the right thing without this commit, as it
was calling FT_MEM_NEW_ARRAY instead of FT_MEM_QNEW_ARRAY
The fixes I'm working with both the Meta security folks and the EL
community (CentOS / AlmaLinux) can be tracked
herehttps://gitlab.com/redhat/centos-stream/rpms/freetype/-/merge_requests/8/diffs
https://gitlab.com/CentOS/Hyperscale/rpms/freetype/-/commits/c9s-hs?ref_type=heads
(we've had to fix it several times in Hyperscale too)
I've tried to keep it well documented so hopefully it's of use to those
trying to patch older releases such as 2.10.4
Best regards,
--
_o) Michel Lind
_( ) identities:
https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
README: https://fedoraproject.org/wiki/User:Salimma#README
Download attachment "signature.asc" of type "application/pgp-signature" (261 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
