Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0

[Marc Deslauriers <marc.deslauriers () canonical com>]

Hi,

On 2025-03-12 16:57, Michel Lind wrote:
> Description:
>
> An out of bounds write exists in FreeType versions 2.13.0 and below
> when attempting to parse font subglyph structures related to TrueType
> GX and variable font files. The vulnerable code assigns a signed short
> value to an unsigned long and then adds a static value causing it to
> wrap around and allocate too small of a heap buffer. The code then
> writes up to 6 signed long integers out of bounds relative to this
> buffer. This may result in arbitrary code execution. This vulnerability
> may have been exploited in the wild.
>
> https://www.facebook.com/security/advisories/cve-2025-27363
>
> This commit fixes most of the issue - except `limit` is still signed
> short - but needs to be redone if you're backporting to 2.10.4
>
> https://gitlab.freedesktop.org/freetype/freetype/-/commit/ef636696524b081f1b8819eb0c6a0b932d35757d

Perhaps I need more coffee this morning, but I'm having trouble consolidating 
that patch with the description. If "limit" is the signed short, what is the 
unsigned long?

Also, if this is meant as the fix:

-        if ( FT_NEW_ARRAY( points, limit + 4 )    ||
-             FT_NEW_ARRAY( tags, limit + 4 )      ||
-             FT_NEW_ARRAY( contours, limit + 4 )  ||
-             FT_NEW_ARRAY( unrounded, limit + 4 ) )
+        if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
+             FT_QNEW_ARRAY( outline.tags, limit )       ||
+             FT_QNEW_ARRAY( outline.contours, limit )   ||
+             FT_QNEW_ARRAY( unrounded, limit + 4 )      )

...not only would the remaining + 4 wrap around too, but FT_NEW_ARRAY already 
checks for a value < 0, so I'm not sure that is it.

What am I not seeing?

Thanks,

Marc.