[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260112142559.GA974242@joooj.vinc17.net>
Date: Mon, 12 Jan 2026 15:25:59 +0100
From: Vincent Lefevre <vincent@...c17.net>
To: oss-security@...ts.openwall.com
Subject: Re: Null Pointer Dereference in HarfBuzz
On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote:
> Aside from the dubious patch, this is a good example of a legitimate bug but
> bogus CVE: how exactly does an attacker trigger this without either having
> *already* completed a DoS attack (consuming all memory) or achieved
> arbitrary code execution (altering the allocator to return NULL even though
> memory is available)?
>
> In short, this is a crash bug, but not a security issue. This is different
> from (for example) a parser bug that results in NULL being dereferenced if
> crafted input is processed.
Note that according to the C standard, dereferencing a null pointer
is undefined behavior, not necessarily a crash. This means that
due to compiler optimizations, unexpected code might be run with
uncontrollable behavior. And it may be difficult to prove that the
code is actually safe despite the optimizations.
--
Vincent Lefèvre <vincent@...c17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
