GNU bug report logs - #81732
[PATCH] 31.0.50; Integer underflow in sfntfont-android.c due to unchecked arithmetic

Message received at submit <at> debbugs.gnu.org:

Received: (at submit) by debbugs.gnu.org; 28 Aug 2026 20:05:04 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Aug 28 16:05:04 2026
Received: from localhost ([127.0.0.1]:51327 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1x02ox-0008Bk-Ah
	for submit <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:05:03 -0400
Received: from lists1p.gnu.org ([2001:470:142::17]:36180)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <divya@HIDDEN>)
 id 1x02oo-00089Q-LH
 for submit <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:04:57 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <divya@HIDDEN>)
 id 1x02NK-000649-8K
 for bug-gnu-emacs@HIDDEN; Fri, 28 Aug 2026 15:36:30 -0400
Received: from latitanza.investici.org ([185.218.207.228])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <divya@HIDDEN>)
 id 1x02NF-00052r-Gz
 for bug-gnu-emacs@HIDDEN; Fri, 28 Aug 2026 15:36:30 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=subvertising.org;
 s=stigmate; t=1787945781;
 bh=mmYAzPpGgk3FNoNccfCTQNUvAltLf0t06WoYQBgNCBg=;
 h=From:To:Subject:Date:From;
 b=aEoP/HC/bYMYMuLcRqu+pNB+pN2NrpE60rc4c6s4DMh2M/US56aSotUuAjcufEWeC
 Nw7RuQREUz7dTvaBjOVrmDnP6IZyrOe327RAWAL43xeZgB17NUIxfzSoCCeN5O+5F7
 sjv7TLI8ZW4Ajj6fMgPCFIsKHipOss1TwoBJyymI=
Received: from mx3.investici.org (unknown [127.0.0.1])
 by latitanza.investici.org (Postfix) with ESMTP id 4hWpXj27svzGpTL
 for <bug-gnu-emacs@HIDDEN>; Fri, 28 Aug 2026 19:36:21 +0000 (UTC)
Received: by mx3.investici.org (Postfix) id 4hWpXh3445zGpTH
 for <bug-gnu-emacs@HIDDEN>; Fri, 28 Aug 2026 19:36:20 +0000 (UTC)
From: Divya Ranjan Pattanaik <divya@HIDDEN>
To: bug-gnu-emacs@HIDDEN
Subject: [PATCH] 31.0.50; Integer underflow in sfntfont-android.c due to
 unchecked arithmetic
X-Debbugs-Cc: Po Lu <luangruo@HIDDEN>
Date: Fri, 28 Aug 2026 19:36:15 +0000
Message-ID: <87tsoe5974.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
Received-SPF: pass client-ip=185.218.207.228;
 envelope-from=divya@HIDDEN; helo=latitanza.investici.org
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 0.9 (/)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.1 (/)

--=-=-=
Content-Type: text/plain

Hello,

I was perusing through Emacs Android's code for font rendering and in `src/sfntfont-android.c` we have the function `sfntfont_android_composite_bitmap`. This function's body checks the input's bounds (rect) for the y coordinate:

```
if (i + rect->y >= bitmap_info->height)
 /* Done. */
 return;
```

But we don't do the same for the x coordinate before we do arithmetic using it:

```
max_x = min (rect->width, bitmap_info->width - rect->x);
```

And inside the second loop:

```
src_x = x + (rect->x - text_rectangle->x);
```

We shouldn't have this arithmetic be executed unconditionally, right? I cannot find a way to exploit this from Emacsisp to verify, but this does look unsafe C to me.

If you agree that it is indeed an actual underflow bug, please find the attached patch that simply adds checks before the arithmetic.

Regards,

Divya Ranjan Pattanaik


--=-=-=
Content-Type: text/x-patch
Content-Disposition: attachment;
 filename=0001-src-sfntfont-android.c-Fix-integer-underflow.patch

From 056c3357a84bb9a4322a07f026186abf8f959590 Mon Sep 17 00:00:00 2001
From: Divya Ranjan Pattanaik <divya@HIDDEN>
Date: Thu, 27 Aug 2026 18:14:56 +0000
Subject: [PATCH] * src/sfntfont-android.c: Fix integer underflow

---
 src/sfntfont-android.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/sfntfont-android.c b/src/sfntfont-android.c
index 7a2e4cb3f8f..f6ae000d4e3 100644
--- a/src/sfntfont-android.c
+++ b/src/sfntfont-android.c
@@ -349,6 +349,12 @@ sfntfont_android_composite_bitmap (unsigned char *restrict buffer,
 	  dst_row = (unsigned int *) (dest + ((i + rect->y)
 					      * bitmap_info->stride));
 
+	  if (rect->x < text_rectangle->x)
+	    return;
+
+	  if (rect->x > bitmap_info->width)
+	    return;
+
 	  /* Figure out where the loop below should end.  */
 	  max_x = min (rect->width, bitmap_info->width - rect->x);
 
-- 
2.54.0


--=-=-=--