From fc85a255849229c024c8e65f536fe1875d84841c Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 3 Jan 2026 08:07:57 +0100 Subject: [PATCH] [ttgxvar] Check for overflow in array size computation. Problem reported and analyzed by povcfe . Fixes issue #1382. * src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Do it. Upstream-Status: Backport [https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c] CVE: CVE-2026-23865 Signed-off-by: Vijay Anusuri --- src/truetype/ttgxvar.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 2ff40c9e8..96ddc04c8 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -628,6 +628,7 @@ FT_UShort word_delta_count; FT_UInt region_idx_count; FT_UInt per_region_size; + FT_UInt delta_set_size; if ( FT_STREAM_SEEK( offset + dataOffsetArray[i] ) ) @@ -697,7 +698,19 @@ if ( long_words ) per_region_size *= 2; - if ( FT_NEW_ARRAY( varData->deltaSet, per_region_size * item_count ) ) + /* Check for overflow (we actually test whether the */ + /* multiplication of two unsigned values wraps around). */ + delta_set_size = per_region_size * item_count; + if ( per_region_size && + delta_set_size / per_region_size != item_count ) + { + FT_TRACE2(( "tt_var_load_item_variation_store:" + " bad delta set array size\n" )); + error = FT_THROW( Array_Too_Large ); + goto Exit; + } + + if ( FT_NEW_ARRAY( varData->deltaSet, delta_set_size ) ) goto Exit; if ( FT_Stream_Read( stream, varData->deltaSet, -- GitLab