Re: FreeType Cache abuses
Alexei Podtelezhnikov <[email protected]> Thu, 23 Apr 2026 09:46:26 -0400
| Newsgroups | gmane.comp.fonts.freetype.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-A2C62672-7024-4D16-A5CF-4CA1075E10A7 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable The feature in question interferes with the normal cache operation by attemp= ting to protect some data from purges. The easiest solution is to disable th= is feature. This would be my solution. I am not motivated to rescue this feature in face= of gotcha tactics. > On Apr 17, 2026, at 18:36, Behdad Esfahbod <[email protected]> wrote: >=20 > However, what tipped my acceptance was that, eg. it shouldn't be possible t= o crash HB from Python bindings. Maybe you can assess these with the same le= ns and decide. >=20 >> We can certainly provide some protections against these abuses but is >> it really worth it? Is it really FreeType's fault or the user's who >> actually triggers use-after-free at last? --Apple-Mail-A2C62672-7024-4D16-A5CF-4CA1075E10A7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html class=3D"apple-mail-supports-explicit-dark-mode"><head><meta http-equi= v=3D"content-type" content=3D"text/html; charset=3Dutf-8"></head><body dir=3D= "auto"><div dir=3D"ltr"><br id=3D"lineBreakAtBeginningOfSignature"><div dir=3D= "ltr">The feature in question interferes with the normal cache operation by a= ttempting to protect some data from purges. The easiest solution is to disab= le this feature.</div><div id=3D"AppleMailSignature" dir=3D"ltr"><br></div><= div id=3D"AppleMailSignature" dir=3D"ltr">This would be my solution. I am no= t motivated to rescue this feature in face of gotcha tactics.</div><div dir=3D= "ltr"><br><blockquote type=3D"cite">On Apr 17, 2026, at 18:36, Behdad Esfahb= od <[email protected]> wrote:<br></blockquote></div><blockquote type=3D= "cite"><div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div>However, what t= ipped my acceptance was that, eg. it shouldn't be possible to crash HB from P= ython bindings. Maybe you can assess these with the same lens and decide.</d= iv><div><br></div></div><div class=3D"gmail_quote gmail_quote_container"><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left= :1px solid rgb(204,204,204);padding-left:1ex">We can certainly provide some p= rotections against these abuses but is<br> it really worth it? Is it really FreeType's fault or the user's who<br> actually triggers use-after-free at last?<br> <br> </blockquote></div> </div></blockquote> </div></body></html>= --Apple-Mail-A2C62672-7024-4D16-A5CF-4CA1075E10A7--