Re: Null Pointer Dereference in HarfBuzz

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 1/12/26 08:25, Vincent Lefevre wrote:
> On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote:
> > Aside from the dubious patch, this is a good example of a legitimate bug but
> > bogus CVE:  how exactly does an attacker trigger this without either having
> > *already* completed a DoS attack (consuming all memory) or achieved
> > arbitrary code execution (altering the allocator to return NULL even though
> > memory is available)?
> >
> > In short, this is a crash bug, but not a security issue.  This is different
> > from (for example) a parser bug that results in NULL being dereferenced if
> > crafted input is processed.
> Note that according to the C standard, dereferencing a null pointer
> is undefined behavior, not necessarily a crash. This means that
> due to compiler optimizations, unexpected code might be run with
> uncontrollable behavior. And it may be difficult to prove that the
> code is actually safe despite the optimizations.

The issue reported here is a write to address zero causing SIGSEGV.  I 
doubt that compilers can optimize placement new to avoid writing through 
the given pointer without introducing undefined behavior in correct 
programs, since the contents of allocated-but-not-initialized memory are 
undefined.


-- Jacob