Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2196077a54c42c97792ab2e69a97e3661827acf6
https://github.com/WebKit/WebKit/commit/2196077a54c42c97792ab2e69a97e3661827acf6
Author: Sabith Saheb <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
Log Message:
-----------
Out-of-bounds read in OpenType vertical GSUB coverage range fill
https://bugs.webkit.org/show_bug.cgi?id=
Reviewed by Michael Catanzaro.
OpenTypeVerticalData loads vertical glyph substitutions from a
downloaded font's GSUB table, which is attacker controlled.
LookupTable::getSubstitutions() fills the substitution map one Coverage
Format 2 range at a time. from and fromEnd were uint16_t with fromEnd
set to end + 1, so a range whose end is 0xffff wraps fromEnd to 0. The
guard indexTo + (fromEnd - from) > countTo then underflows on the
truncated value and passes, and the inner loop walks from start through
0xffff before from wraps back to 0, reading
singleSubstitution2->substitute[indexTo] far past its validated
glyphCount entries. substitute is a raw pointer into the GSUB buffer, so
this is an unchecked heap read past the table. A reversed range with
start greater than end underflows the same guard.
Widen from and fromEnd to unsigned so end + 1 stays exact, and reject
fromEnd <= from to drop reversed and empty ranges before the copy. Valid
ranges map the same glyphs as before.
* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
(WebCore::OpenType::LookupTable::getSubstitutions):
Canonical link: https://commits.webkit.org/319036@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
