Re: Security Report: Unbounded Composite Glyph Recursion DoS (CWE-674)
Alexei Podtelezhnikov <[email protected]> Wed, 25 Mar 2026 08:49:23 -0700
| Newsgroups | gmane.comp.fonts.freetype.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-36305DA1-FE14-4EE7-AD20-210227B5B64C Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable >=20 > SUMMARY >=20 > load_truetype_glyph() in src/truetype/ttgload.c recurses without a depth l= imit when processing composite glyphs. A crafted TTF with a 30,000-deep chai= n of unique composite glyph indices exhausts the process stack and crashes w= ith SIGSEGV. This is fixed in 2.14.3.= --Apple-Mail-36305DA1-FE14-4EE7-AD20-210227B5B64C Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <html class="apple-mail-supports-explicit-dark-mode"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><br></div><blockquote type="cite"><div dir="ltr"><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt;"><div class="jsCTWR"><div data-rmvstyle-oncpy="true" style=""><div role="document" tabindex="0" class="jsConTent zm-nofocus" lang="en"><div><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt"><div><br></div><div>SUMMARY<br></div><div><br></div><div>load_truetype_glyph() in src/truetype/ttgload.c recurses without a depth limit when processing composite glyphs. A crafted TTF with a 30,000-deep chain of unique composite glyph indices exhausts the process stack and crashes with SIGSEGV.</div></div></div></div></div></div></div></div></blockquote><br><div>This is fixed in 2.14.3.</div></body></html> --Apple-Mail-36305DA1-FE14-4EE7-AD20-210227B5B64C--