Eli Zaretskii <eliz@HIDDEN>
to control <at> debbugs.gnu.org.
Full text available.Received: (at 81733) by debbugs.gnu.org; 29 Aug 2026 06:05:55 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Sat Aug 29 02:05:55 2026 Received: from localhost ([127.0.0.1]:54136 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1x0CCQ-0001qi-NR for submit <at> debbugs.gnu.org; Sat, 29 Aug 2026 02:05:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59780) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from <eliz@HIDDEN>) id 1x0CCO-0001px-Fo; Sat, 29 Aug 2026 02:05:52 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <eliz@HIDDEN>) id 1x0CCI-0005Yi-SW; Sat, 29 Aug 2026 02:05:46 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=NOJuD9laKP6x0gBw4jkxG/4DvXPaStpnGV0y0NM7ec4=; b=S2xeKY5WRewj 6pFit6hc4QkbVbn40rg3SOvz8wDSRy8QVh7y0ARPeRSGVzQMPIYXSH67Vk0kOc/Xaiq2LK2IqZEEn DKhTH0PbUuHSCfNluwrIh3DSC8TYB9LHZmEFF8SaZa7D0lxsr+pN9K41/NTqtmKI3qiaYExndliAw Os3mFbsK0zroMrCVQF13EQTWEYE0dJ3f7X0qkwqhwOUGj+Ijz8p66054Q8Wy9cWsUyXp7ybppBcnM xZzEfwSo7ljRUJ8FQMKYHghcl1MlBN8zgmzXi9gKhMqMrlMYdUwTm8vYjUHiBCyOqVfvASfTWbrGx JPXPNZXgE9MmCfO9RfeIsQ==; Date: Sat, 29 Aug 2026 09:05:43 +0300 Message-Id: <86mru5cvgo.fsf@HIDDEN> From: Eli Zaretskii <eliz@HIDDEN> To: Divya Ranjan Pattanaik <divya@HIDDEN> In-Reply-To: <87v78u5c4t.fsf@HIDDEN> (bug-gnu-emacs@HIDDEN) Subject: Re: bug#81733: [PATCH] 31.0.50; Integer underflow in sfntfont-android.c due to unchecked arithmetic References: <87v78u5c4t.fsf@HIDDEN> X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 81733 Cc: luangruo@HIDDEN, 81733 <at> debbugs.gnu.org X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.7 (-) merge 81733 81732 thanks > Cc: Po Lu <luangruo@HIDDEN> > Date: Fri, 28 Aug 2026 18:32:50 +0000 > From: Divya Ranjan Pattanaik via "Bug reports for GNU Emacs, > the Swiss army knife of text editors" <bug-gnu-emacs@HIDDEN> > > Hello, > > I was perusing through Emacs Android's code for font rendering and in `src/sfntfont-android.c` we have the function `sfntfont_android_composite_bitmap`. This function's body checks the input's bounds (rect) for the y coordinate: This is an exact duplicate of bug#81732, so I'm merging them.
bug-gnu-emacs@HIDDEN:bug#81733; Package emacs.
Full text available.Received: (at 81733) by debbugs.gnu.org; 28 Aug 2026 20:16:47 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Fri Aug 28 16:16:47 2026 Received: from localhost ([127.0.0.1]:51411 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1x030J-0001Pu-0Y for submit <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:16:47 -0400 Received: from confino.investici.org ([93.190.126.19]:26739) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from <divya@HIDDEN>) id 1x030D-0001P2-4g for 81733 <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:16:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=subvertising.org; s=stigmate; t=1787948199; bh=EdeNci/w5S7j46moiG/zgIpWOCubWad7FpTLAZIqSG4=; h=Date:From:To:Subject:In-Reply-To:References:From; b=dimWFEOT3s2/pGSG7/fCYJOkQrcj0KIqzSlixPkpvojmUMnh5uBZrtvKROqW1EIWz Zd+GW9MUddfRMxU4f7uKBb1zfbdocPRW3vYcc/3CKkjUBjPCGO0WqpF3Gi8wNztGTb hIM0ttuR2MClDX6LAdrJDGeETwHCceU3MJHy2ftk= Received: from mx1.investici.org (unknown [127.0.0.1]) by confino.investici.org (Postfix) with ESMTP id 4hWqRC3CZVz11B1 for <81733 <at> debbugs.gnu.org>; Fri, 28 Aug 2026 20:16:39 +0000 (UTC) Received: by mx1.investici.org (Postfix) id 4hWqRB2TfPz118j for <81733 <at> debbugs.gnu.org>; Fri, 28 Aug 2026 20:16:38 +0000 (UTC) Date: Sat, 29 Aug 2026 01:46:31 +0530 From: Divya Ranjan Pattanaik <divya@HIDDEN> To: 81733 <at> debbugs.gnu.org Subject: =?US-ASCII?Q?Re=3A_bug=2381733=3A_Acknowledgemen?= =?US-ASCII?Q?t_=28=5BPATCH=5D_31=2E0=2E50=3B_Integer_u?= =?US-ASCII?Q?nderflow_in_sfntfont-android=2E?= =?US-ASCII?Q?c_due_to_unchecked_arithmetic=29?= User-Agent: Thunderbird for Android In-Reply-To: <handler.81733.B.178794750531521.ack <at> debbugs.gnu.org> References: <87v78u5c4t.fsf@HIDDEN> <handler.81733.B.178794750531521.ack <at> debbugs.gnu.org> Message-ID: <B7AA9239-D606-40E6-97FE-B3425FEA9D6C@HIDDEN> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=----944CR5PSNQG23RU1OU51HU6385C4PW Content-Transfer-Encoding: 7bit X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 81733 X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -1.7 (-) ------944CR5PSNQG23RU1OU51HU6385C4PW Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Please close this one=2E My mail service was having issues, so accidentally= opened a duplicate bug report=2E On 29 August 2026 01:36:03 GMT+05:30, help-debbugs@gnu=2Eorg wrote: >Thank you for filing a new bug report with debbugs=2Egnu=2Eorg=2E > >This is an automatically generated reply to let you know your message >has been received=2E > >Your message is being forwarded to the package maintainers and other >interested parties for their attention; they will reply in due course=2E > >As you requested using X-Debbugs-CC, your message was also forwarded to > Po Lu <luangruo@yahoo=2Ecom> >(after having been given a bug report number, if it did not have one)=2E > >Your message has been sent to the package maintainer(s): > bug-gnu-emacs@gnu=2Eorg > >If you wish to submit further information on this problem, please >send it to 81733@debbugs=2Egnu=2Eorg=2E > >Please do not send mail to help-debbugs@gnu=2Eorg unless you wish >to report a problem with the Bug-tracking system=2E > >--=20 >81733: https://debbugs=2Egnu=2Eorg/cgi/bugreport=2Ecgi?bug=3D81733 >GNU Bug Tracking System >Contact help-debbugs@gnu=2Eorg with problems Philosophy, Mathematics, Libre Software ------944CR5PSNQG23RU1OU51HU6385C4PW Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div dir=3D"auto">Please close this one=2E My mail= service was having issues, so accidentally opened a duplicate bug report= =2E</div><br><br><div class=3D"gmail_quote"><div dir=3D"auto">On 29 August = 2026 01:36:03 GMT+05:30, help-debbugs@gnu=2Eorg wrote:</div><blockquote cla= ss=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; border-left: 1px s= olid rgb(204, 204, 204); padding-left: 1ex;"> <pre class=3D"net-thunderbird-android__plain-text-message-pre"><div dir=3D= "auto">Thank you for filing a new bug report with debbugs=2Egnu=2Eorg=2E<br= ><br>This is an automatically generated reply to let you know your message<= br>has been received=2E<br><br>Your message is being forwarded to the packa= ge maintainers and other<br>interested parties for their attention; they wi= ll reply in due course=2E<br><br>As you requested using X-Debbugs-CC, your = message was also forwarded to<br> Po Lu <luangruo@yahoo=2Ecom><br>(a= fter having been given a bug report number, if it did not have one)=2E<br><= br>Your message has been sent to the package maintainer(s):<br> bug-gnu-ema= cs@gnu=2Eorg<br><br>If you wish to submit further information on this probl= em, please<br>send it to 81733@debbugs=2Egnu=2Eorg=2E<br><br>Please do not = send mail to help-debbugs@gnu=2Eorg unless you wish<br>to report a problem = with the Bug-tracking system=2E<br><br></div></pre></blockquote></div><div = dir=3D"auto">Philosophy, Mathematics, Libre Software</div></body></html> ------944CR5PSNQG23RU1OU51HU6385C4PW--
bug-gnu-emacs@HIDDEN:bug#81733; Package emacs.
Full text available.Received: (at submit) by debbugs.gnu.org; 28 Aug 2026 20:05:05 +0000 From debbugs-submit-bounces <at> debbugs.gnu.org Fri Aug 28 16:05:04 2026 Received: from localhost ([127.0.0.1]:51331 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>) id 1x02oy-0008C1-1q for submit <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:05:04 -0400 Received: from lists1p.gnu.org ([2001:470:142::17]:36180) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from <divya@HIDDEN>) id 1x02or-00089Q-Jm for submit <at> debbugs.gnu.org; Fri, 28 Aug 2026 16:04:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <divya@HIDDEN>) id 1x01O7-00089i-LO for bug-gnu-emacs@HIDDEN; Fri, 28 Aug 2026 14:33:16 -0400 Received: from confino.investici.org ([2a11:7980:1::2:0]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <divya@HIDDEN>) id 1x01O5-0001tC-Ol for bug-gnu-emacs@HIDDEN; Fri, 28 Aug 2026 14:33:15 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=subvertising.org; s=stigmate; t=1787941979; bh=mmYAzPpGgk3FNoNccfCTQNUvAltLf0t06WoYQBgNCBg=; h=From:To:Subject:Date:From; b=GCjRrfYepN7mSwjcl9be/AmfTd5anSndDq8hqEePq1yC+aH8InHTHUIcSycC60tcM f7kKc3neWZtLJQ4tT6OXWgXKdzIzYZmpGKlGDwz6F4+2ZALUuE2U91tk97au/pTIVB vlgCZpuVzoNNklsOGFJ1Oad+9BIS8x+ldjyLSdcY= Received: from mx1.investici.org (unknown [127.0.0.1]) by confino.investici.org (Postfix) with ESMTP id 4hWn7b5x4bz118j for <bug-gnu-emacs@HIDDEN>; Fri, 28 Aug 2026 18:32:59 +0000 (UTC) Received: by mx1.investici.org (Postfix) id 4hWn7Z4ZDNz110q for <bug-gnu-emacs@HIDDEN>; Fri, 28 Aug 2026 18:32:58 +0000 (UTC) From: Divya Ranjan Pattanaik <divya@HIDDEN> To: bug-gnu-emacs@HIDDEN Subject: [PATCH] 31.0.50; Integer underflow in sfntfont-android.c due to unchecked arithmetic X-Debbugs-Cc: Po Lu <luangruo@HIDDEN> Date: Fri, 28 Aug 2026 18:32:50 +0000 Message-ID: <87v78u5c4t.fsf@HIDDEN> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Received-SPF: pass client-ip=2a11:7980:1::2:0; envelope-from=divya@HIDDEN; helo=confino.investici.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: 0.9 (/) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit <at> debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: <debbugs-submit.debbugs.gnu.org> List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe> List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/> List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org> List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help> List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe> Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org> X-Spam-Score: -0.1 (/) --=-=-= Content-Type: text/plain Hello, I was perusing through Emacs Android's code for font rendering and in `src/sfntfont-android.c` we have the function `sfntfont_android_composite_bitmap`. This function's body checks the input's bounds (rect) for the y coordinate: ``` if (i + rect->y >= bitmap_info->height) /* Done. */ return; ``` But we don't do the same for the x coordinate before we do arithmetic using it: ``` max_x = min (rect->width, bitmap_info->width - rect->x); ``` And inside the second loop: ``` src_x = x + (rect->x - text_rectangle->x); ``` We shouldn't have this arithmetic be executed unconditionally, right? I cannot find a way to exploit this from Emacsisp to verify, but this does look unsafe C to me. If you agree that it is indeed an actual underflow bug, please find the attached patch that simply adds checks before the arithmetic. Regards, Divya Ranjan Pattanaik --=-=-= Content-Type: text/x-patch Content-Disposition: attachment; filename=0001-src-sfntfont-android.c-Fix-integer-underflow.patch From 056c3357a84bb9a4322a07f026186abf8f959590 Mon Sep 17 00:00:00 2001 From: Divya Ranjan Pattanaik <divya@HIDDEN> Date: Thu, 27 Aug 2026 18:14:56 +0000 Subject: [PATCH] * src/sfntfont-android.c: Fix integer underflow --- src/sfntfont-android.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/sfntfont-android.c b/src/sfntfont-android.c index 7a2e4cb3f8f..f6ae000d4e3 100644 --- a/src/sfntfont-android.c +++ b/src/sfntfont-android.c @@ -349,6 +349,12 @@ sfntfont_android_composite_bitmap (unsigned char *restrict buffer, dst_row = (unsigned int *) (dest + ((i + rect->y) * bitmap_info->stride)); + if (rect->x < text_rectangle->x) + return; + + if (rect->x > bitmap_info->width) + return; + /* Figure out where the loop below should end. */ max_x = min (rect->width, bitmap_info->width - rect->x); -- 2.54.0 --=-=-=--
Divya Ranjan Pattanaik <divya@HIDDEN>:luangruo@HIDDEN, bug-gnu-emacs@HIDDEN.
Full text available.luangruo@HIDDEN, bug-gnu-emacs@HIDDEN:bug#81733; Package emacs.
Full text available.
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997 nCipher Corporation Ltd,
1994-97 Ian Jackson.