Re: FreeType Cache abuses

--000000000000e692a0064faf9205
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

We received many similar reports on HarfBuzz; My initial response was that
it's a user's own fault if they want to shoot themselves in the foot using
the C API.

However, what tipped my acceptance was that, eg. it shouldn't be possible
to crash HB from Python bindings. Maybe you can assess these with the same
lens and decide.

behdad
http://behdad.org/


On Thu, Apr 16, 2026 at 7:48=E2=80=AFPM Alexei Podtelezhnikov <apodtele@gma=
il.com>
wrote:

> Hi all
>
> We've recently received two reports with potential security
> implications when FreeType Cache is abused in very specific and
> unusual ways.
>
> https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1401
> https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1418
>
> In both cases, first the lookup functions are called to obtain the
> FTC_Node reference pointer as the last argument. Then the cache is
> forced to abandon and free the node leaving the dangling pointer. At
> last, the user triggers use-after-free.
>
> We can certainly provide some protections against these abuses but is
> it really worth it? Is it really FreeType's fault or the user's who
> actually triggers use-after-free at last?
>
> Werner will shortly lift the confidential flag. We would appreciate
> your feedback and assessment from the local security experts.
>
> Thank you
> Alexei
>
>

--000000000000e692a0064faf9205
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>We received many similar reports on HarfBuzz; My init=
ial response was that it&#39;s a user&#39;s own fault if they want to shoot=
 themselves in the foot using the C API.</div><div><br></div><div>However, =
what tipped my acceptance was that, eg. it shouldn&#39;t be possible to cra=
sh HB from Python bindings. Maybe you can assess these with the same lens a=
nd decide.</div><div><br></div><div><div dir=3D"ltr" class=3D"gmail_signatu=
re" data-smartmail=3D"gmail_signature">behdad<br><a href=3D"http://behdad.o=
rg/" target=3D"_blank">http://behdad.org/</a></div></div><br></div><br><div=
 class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmai=
l_attr">On Thu, Apr 16, 2026 at 7:48=E2=80=AFPM Alexei Podtelezhnikov &lt;<=
a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left:1px solid rgb(204,204,204);padding-left:1ex">Hi all<br>
<br>
We&#39;ve recently received two reports with potential security<br>
implications when FreeType Cache is abused in very specific and<br>
unusual ways.<br>
<br>
<a href=3D"https://gitlab.freedesktop.org/freetype/freetype/-/work_items/14=
01" rel=3D"noreferrer" target=3D"_blank">https://gitlab.freedesktop.org/fre=
etype/freetype/-/work_items/1401</a><br>
<a href=3D"https://gitlab.freedesktop.org/freetype/freetype/-/work_items/14=
18" rel=3D"noreferrer" target=3D"_blank">https://gitlab.freedesktop.org/fre=
etype/freetype/-/work_items/1418</a><br>
<br>
In both cases, first the lookup functions are called to obtain the<br>
FTC_Node reference pointer as the last argument. Then the cache is<br>
forced to abandon and free the node leaving the dangling pointer. At<br>
last, the user triggers use-after-free.<br>
<br>
We can certainly provide some protections against these abuses but is<br>
it really worth it? Is it really FreeType&#39;s fault or the user&#39;s who=
<br>
actually triggers use-after-free at last?<br>
<br>
Werner will shortly lift the confidential flag. We would appreciate<br>
your feedback and assessment from the local security experts.<br>
<br>
Thank you<br>
Alexei<br>
<br>
</blockquote></div>

--000000000000e692a0064faf9205--