oss-security - Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <27e2f23c-464a-44d7-9b7b-0679a6d348fa@app.fastmail.com>
Date: Fri, 14 Mar 2025 09:14:15 -0500
From: "Michel Lind" <michel@...hel-slm.name>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0



On Fri, Mar 14, 2025, at 7:55 AM, Marc Deslauriers wrote:
> Hi Michel,
>
> On 2025-03-13 22:54, Michel Lind wrote:
>> 
>> The fixes I'm working with both the Meta security folks and the EL
>> community (CentOS / AlmaLinux) can be tracked
>> herehttps://gitlab.com/redhat/centos-stream/rpms/freetype/-/merge_requests/8/diffs
>
> I think if you're removing the 4 "phantom points" from outline.n_point 
> and 
> outline.n_contours, you probably need to add them back in other places, 
> like the 
> parts you are missing from this patch does:
>
> https://gitlab.freedesktop.org/freetype/freetype/-/commit/47103b2f195e0f9664c9470182f063cb7d41dc9f
>
That's a good call. I've been slightly concerned about those 4 points too. Will probably have to cut another fix

> Is there a reproducer available for this CVE? I was thinking of just doing a 
> minimal fix for older freetype versions in Ubuntu, maybe something like this:
>
> -- a/src/truetype/ttgload.c
> +++ b/src/truetype/ttgload.c
> @@ -1957,6 +1957,13 @@
>
>           limit = (short)gloader->current.num_subglyphs;
>
> +        /* make sure this isn't negative as we're going to add 4 later */
> +        if ( limit < 0 )
> +        {
> +          error = FT_THROW( Invalid_Argument );
> +          goto Exit;
> +        }
> +
>           /* construct an outline structure for              */
>           /* communication with `TT_Vary_Apply_Glyph_Deltas' */
>           outline.n_points   = (short)( gloader->current.num_subglyphs + 4 );
>
>
I'll ask the security folks to weigh in again

Thanks,

-- 
 _o) Michel Lind
_( ) identities: https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
     README:     https://michel-slm.name/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.