From 26b83ec58c60ced0e6c423df438227fb33ccca2e Mon Sep 17 00:00:00 2001
From: Marc Deslauriers <marc.deslauriers@ubuntu.com>
Date: Thu, 13 Mar 2025 08:41:20 -0400
Subject: [PATCH] fix OOB write when when attempting to parse font subglyph
 structures

Gbp-Pq: CVE-2025-27363.patch.

Source: https://git.launchpad.net/ubuntu/+source/freetype/commit/?h=applied/ubuntu/jammy-devel&id=fc406fb02653852dfa5979672e3d8d56ed329186

CVE: CVE-2025-27363
Upstream-Status: Inappropriate [cannot do exact patch backport as the code changed too much]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 src/truetype/ttgload.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 11968f6..f5aa292 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -1948,7 +1948,7 @@
         short        i, limit;
         FT_SubGlyph  subglyph;
 
-        FT_Outline  outline;
+        FT_Outline  outline = { 0, 0, NULL, NULL, NULL, 0 };
         FT_Vector*  points    = NULL;
         char*       tags      = NULL;
         short*      contours  = NULL;
@@ -1957,6 +1957,13 @@
 
         limit = (short)gloader->current.num_subglyphs;
 
+        /* make sure this isn't negative as we're going to add 4 later */
+        if ( limit < 0 )
+        {
+          error = FT_THROW( Invalid_Argument );
+          goto Exit;
+        }
+
         /* construct an outline structure for              */
         /* communication with `TT_Vary_Apply_Glyph_Deltas' */
         outline.n_points   = (short)( gloader->current.num_subglyphs + 4 );
