Re: Security Report: Unbounded Composite Glyph Recursion DoS (CWE-674)
Sean McBride <[email protected]> Wed, 25 Mar 2026 17:39:36 -0400
| Newsgroups | gmane.comp.fonts.freetype.devel |
|---|---|
| Message-ID | <[email protected]> |
--=_MailMate_2945D6CE-E5A1-4461-9CB6-615A8EBCD557_= Content-Type: text/plain; format=flowed; markup=markdown On 25 Mar 2026, at 17:20, Alan Coopersmith wrote: > On 3/25/26 13:01, J Laratro wrote: >> There is also no way to disclose security issues through the GitHub: >> https:// github.com/freetype/freetype/security > > As it says on the front page of https://github.com/freetype/freetype > the > github is just a mirror of the main repo at > https://gitlab.freedesktop.org/freetype/freetype > and if you scroll down to the README on the github you'll see it also > links to the gitlab to report bugs. Still, he's not wrong that https://freetype.org/contact.html could be improved. 1. explicitly mentioning contact instruction for security issues. 2. mentioning that the mailing lists are *public*. (a lot of my young interns have never been exposed to the concept of public mailing lists via email. their universe only includes things like slack, discourse, etc.) Sean --=_MailMate_2945D6CE-E5A1-4461-9CB6-615A8EBCD557_= Content-Type: text/html Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/xhtml; charset=3Dutf-8"= > </head> <body><div style=3D"font-family: sans-serif;"><div class=3D"markdown" sty= le=3D"white-space: normal;"> <p dir=3D"auto">On 25 Mar 2026, at 17:20, Alan Coopersmith wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #777777; color: #777777;"> <p dir=3D"auto">On 3/25/26 13:01, J Laratro wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #777777; border-left-color: #999999; color: #999999;"> <p dir=3D"auto">There is also no way to disclose security issues through = the GitHub: https:// github.com/freetype/freetype/security</p> </blockquote> <p dir=3D"auto">As it says on the front page of <a href=3D"https://github= =2Ecom/freetype/freetype" style=3D"color: #777777;">https://github.com/fr= eetype/freetype</a> the<br> github is just a mirror of the main repo at<br> <a href=3D"https://gitlab.freedesktop.org/freetype/freetype" style=3D"col= or: #777777;">https://gitlab.freedesktop.org/freetype/freetype</a><br> and if you scroll down to the README on the github you'll see it also<br>= links to the gitlab to report bugs.</p> </blockquote> <p dir=3D"auto">Still, he's not wrong that <a href=3D"https://freetype.or= g/contact.html" style=3D"color: #3983C4;">https://freetype.org/contact.ht= ml</a> could be improved.</p> <ol> <li>explicitly mentioning contact instruction for security issues.</li> <li>mentioning that the mailing lists are <em>public</em>. (a lot of my y= oung interns have never been exposed to the concept of public mailing lis= ts via email. their universe only includes things like slack, discourse, = etc.)</li> </ol> <p dir=3D"auto">Sean</p> </div> </div> </body> </html> --=_MailMate_2945D6CE-E5A1-4461-9CB6-615A8EBCD557_=--