Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0

[Michel Lind <michel () michel-slm name>]

On Thu, 2025-03-13 at 20:50 +0000, Vulnerability Disclosure wrote:
> In the following change
>
> +        if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
> +             FT_QNEW_ARRAY( outline.tags, limit )       ||
> +             FT_QNEW_ARRAY( outline.contours, limit )   ||
> +             FT_QNEW_ARRAY( unrounded, limit + 4 )      )
>
> The out of bounds write requires a short integer overflow with a
> limit value of 0xFFFD - 0xFFFF. In the patch when we change the
> second call to FT_QNEW_ARRAY to remove the addition of +4 the size
> value is now negative and the call to FT_QNEW_ARRAY call will fail
> with an error code causing the logic to short circuit and prevent the
> out of bounds write from occurring. While limit is still signed the
> security risk is mitigated by the early exit condition.
>
> If we also want to make the limit variable unsigned, we can
> additionally patch based off the following FreeType commit:
>
> https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442
As a follow-up to that (sorry to keep trickling in information) - it
turns out a third commit is required

https://gitlab.freedesktop.org/freetype/freetype/-/commit/c71eb22dde1a3101891a865fdac20a6de814267d

FT_QNEW_ARRAY does not do the right thing without this commit, as it
was calling FT_MEM_NEW_ARRAY instead of FT_MEM_QNEW_ARRAY

The fixes I'm working with both the Meta security folks and the EL
community (CentOS / AlmaLinux) can be tracked
herehttps://gitlab.com/redhat/centos-stream/rpms/freetype/-/merge_requests/8/diffs

https://gitlab.com/CentOS/Hyperscale/rpms/freetype/-/commits/c9s-hs?ref_type=heads

(we've had to fix it several times in Hyperscale too)

I've tried to keep it well documented so hopefully it's of use to those
trying to patch older releases such as 2.10.4

Best regards,

-- 
 _o) Michel Lind
_( ) identities:
https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
     README:     https://fedoraproject.org/wiki/User:Salimma#README

Attachment: signature.asc
Description: This is a digitally signed message part