Re: [SECURITY] Heap Use-After-Free in FT_Bitmap_Copy

Alexei Podtelezhnikov <[email protected]> Tue, 27 Jan 2026 21:31:13 -0500

Newsgroups	gmane.comp.fonts.freetype.devel
Message-ID	<CAJU=AjXmCTmMU2CwGjoRhOcS=bP7Qq8yFN8e00uTgkytmxrTBQ@mail.gmail.com>

[quote]
/* do lazy copying whenever possible */
if ( slot->internal->flags & FT_GLYPH_OWN_BITMAP )
{
  glyph->bitmap          = slot->bitmap;       // Just copies the pointer!
  slot->internal->flags &= ~FT_GLYPH_OWN_BITMAP;  // Clears ownership flag
  // BUG: slot->bitmap.buffer is NOT set to NULL!
}
[/quote]

This is an interesting proposal. I think I agree but we should also
set FT_GLYPH_FORMAT_NONE.