Re: Null Pointer Dereference in HarfBuzz

[Vincent Lefevre <vincent () vinc17 net>]

On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote:
> Aside from the dubious patch, this is a good example of a legitimate bug but
> bogus CVE:  how exactly does an attacker trigger this without either having
> *already* completed a DoS attack (consuming all memory) or achieved
> arbitrary code execution (altering the allocator to return NULL even though
> memory is available)?
>
> In short, this is a crash bug, but not a security issue.  This is different
> from (for example) a parser bug that results in NULL being dereferenced if
> crafted input is processed.

Note that according to the C standard, dereferencing a null pointer
is undefined behavior, not necessarily a crash. This means that
due to compiler optimizations, unexpected code might be run with
uncontrollable behavior. And it may be difficult to prove that the
code is actually safe despite the optimizations.

-- 
Vincent Lefèvre <vincent () vinc17 net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)