Potential integer underflow due to unchecked arithmetic

Hello Po,

I was perusing through Emacs Android's code for font rendering and in `src/sfntfont-android.c` we have the function `sfntfont_android_composite_bitmap`. This function's body checks the input's bounds (rect) for the y coordinate:

```
if (i + rect->y >= bitmap_info->height)
 /* Done. */
 return;
```

But we don't do the same for the x coordinate before we do arithmetic using it:

```
max_x = min (rect->width, bitmap_info->width - rect->x);
```

And inside the second loop:

```
src_x = x + (rect->x - text_rectangle->x);
```

We shouldn't have this arithmetic be executed unconditionally, right? I cannot find a way to exploit this from Emacsisp to verify, but this does look unsafe C to me.

If you agree that it is indeed an actual underflow bug, please find the attached patch that simply adds checks before the arithmetic.
Divya Ranjan Pattanaik

Mathematics, Philosophy & Libre Software

From 056c3357a84bb9a4322a07f026186abf8f959590 Mon Sep 17 00:00:00 2001
From: Divya Ranjan Pattanaik <[email protected]>
Date: Thu, 27 Aug 2026 18:14:56 +0000
Subject: [PATCH] * src/sfntfont-android.c: Fix integer underflow

---
 src/sfntfont-android.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/sfntfont-android.c b/src/sfntfont-android.c
index 7a2e4cb3f8f..f6ae000d4e3 100644
--- a/src/sfntfont-android.c
+++ b/src/sfntfont-android.c
@@ -349,6 +349,12 @@ sfntfont_android_composite_bitmap (unsigned char *restrict buffer,
 	  dst_row = (unsigned int *) (dest + ((i + rect->y)
 					      * bitmap_info->stride));
 
+	  if (rect->x < text_rectangle->x)
+	    return;
+
+	  if (rect->x > bitmap_info->width)
+	    return;
+
 	  /* Figure out where the loop below should end.  */
 	  max_x = min (rect->width, bitmap_info->width - rect->x);
 
-- 
2.54.0