[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6c34559b-d38a-49d3-8917-8ea3d235f77c@gmail.com>
Date: Mon, 12 Jan 2026 23:33:37 -0600
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Null Pointer Dereference in HarfBuzz
On 1/12/26 08:25, Vincent Lefevre wrote:
> On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote:
>> Aside from the dubious patch, this is a good example of a legitimate bug but
>> bogus CVE: how exactly does an attacker trigger this without either having
>> *already* completed a DoS attack (consuming all memory) or achieved
>> arbitrary code execution (altering the allocator to return NULL even though
>> memory is available)?
>>
>> In short, this is a crash bug, but not a security issue. This is different
>> from (for example) a parser bug that results in NULL being dereferenced if
>> crafted input is processed.
> Note that according to the C standard, dereferencing a null pointer
> is undefined behavior, not necessarily a crash. This means that
> due to compiler optimizations, unexpected code might be run with
> uncontrollable behavior. And it may be difficult to prove that the
> code is actually safe despite the optimizations.
The issue reported here is a write to address zero causing SIGSEGV. I
doubt that compilers can optimize placement new to avoid writing through
the given pointer without introducing undefined behavior in correct
programs, since the contents of allocated-but-not-initialized memory are
undefined.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
