Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <402ad4ad-a846-4b17-b32c-fa0ea120cd36@canonical.com>
Date: Fri, 14 Mar 2025 07:50:22 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-27363: out of bounds write in FreeType <=
 2.13.0

On 2025-03-13 16:50, Vulnerability Disclosure wrote:
> In the following change
> 
> +        if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
> +             FT_QNEW_ARRAY( outline.tags, limit )       ||
> +             FT_QNEW_ARRAY( outline.contours, limit )   ||
> +             FT_QNEW_ARRAY( unrounded, limit + 4 )      )
> 
> The out of bounds write requires a short integer overflow with a limit value of 0xFFFD - 0xFFFF. In the patch when we change the second call to FT_QNEW_ARRAY to remove the addition of +4 the size value is now negative and the call to FT_QNEW_ARRAY call will fail with an error code causing the logic to short circuit and prevent the out of bounds write from occurring. While limit is still signed the security risk is mitigated by the early exit condition.

Oh I see, this commit wasn't written as a security fix, it just happens to now 
trigger the negative number check in FT_QNEW_ARRAY which prevents the issue from 
happening.

> 
> If we also want to make the limit variable unsigned, we can additionally patch based off the following FreeType commit:
> 
> https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442
> 

Ultimately this is the proper fix, but there are a whole slew of other changes 
that went into 2.13.3 to go along with it that change signed short to unsigned 
short in a bunch of other places, such as FT_Outline. Just backporting that 
commit will prevent limit from going negative and the check in FT_QNEW_ARRAY 
will no longer work.

Marc.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.