[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260113123402.GD279805@cventin.lip.ens-lyon.fr>
Date: Tue, 13 Jan 2026 13:34:02 +0100
From: Vincent Lefevre <vincent@...c17.net>
To: oss-security@...ts.openwall.com
Subject: Re: Null Pointer Dereference in HarfBuzz
On 2026-01-12 23:33:37 -0600, Jacob Bachmeyer wrote:
> The issue reported here is a write to address zero causing SIGSEGV. I doubt
> that compilers can optimize placement new to avoid writing through the given
> pointer without introducing undefined behavior in correct programs, since
> the contents of allocated-but-not-initialized memory are undefined.
Perhaps in the case of HarfBuzz. But this is not necessarily the case
everywhere. Consider the following code:
------------------------------------------------------------
#include <stdio.h>
#include <stdlib.h>
__attribute__((noipa)) // imagine it in a separate TU
int ptest (int *p)
{
return p != 0;
}
int main (void)
{
int *p = malloc (99999999999);
int r = ptest (p);
p[0] = 12345;
free (p);
printf ("%d\n", r);
return 0;
}
------------------------------------------------------------
On my machine, with GCC and optimizations (e.g. -O), the output is 0
while such a value could be regarded as impossible by the program
Due to optimizations, one cannot rely on a crash if the memory could
not be allocated. So a more complex program would continue with
inconsistent information.
--
Vincent Lefèvre <vincent@...c17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
