From 26b83ec58c60ced0e6c423df438227fb33ccca2e Mon Sep 17 00:00:00 2001 From: Marc Deslauriers Date: Thu, 13 Mar 2025 08:41:20 -0400 Subject: [PATCH] fix OOB write when when attempting to parse font subglyph structures Gbp-Pq: CVE-2025-27363.patch. Source: https://git.launchpad.net/ubuntu/+source/freetype/commit/?h=applied/ubuntu/jammy-devel&id=fc406fb02653852dfa5979672e3d8d56ed329186 CVE: CVE-2025-27363 Upstream-Status: Inappropriate [cannot do exact patch backport as the code changed too much] Signed-off-by: Peter Marko --- src/truetype/ttgload.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c index 11968f6..f5aa292 100644 --- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -1948,7 +1948,7 @@ short i, limit; FT_SubGlyph subglyph; - FT_Outline outline; + FT_Outline outline = { 0, 0, NULL, NULL, NULL, 0 }; FT_Vector* points = NULL; char* tags = NULL; short* contours = NULL; @@ -1957,6 +1957,13 @@ limit = (short)gloader->current.num_subglyphs; + /* make sure this isn't negative as we're going to add 4 later */ + if ( limit < 0 ) + { + error = FT_THROW( Invalid_Argument ); + goto Exit; + } + /* construct an outline structure for */ /* communication with `TT_Vary_Apply_Glyph_Deltas' */ outline.n_points = (short)( gloader->current.num_subglyphs + 4 );