Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for cairoftunscaledfontfini in cairo-ft-font.c.

It was found that specially crafted SVG file can trigger crash in pngwriterow when converting the given SVG using librsvg2 and cairo. Crash happens inside libpng when trying to access invalid pointer.

Acknowledgements:

Name: Gustavo Grieco

Peter Valchev from the Google Security Team told the Cairo upstream project of an integer overflow in the way Cairo decodes PNG image data. To quote the mail from Peter:

As an example, cairo supports creating a new image surface from a PNG image file - see cairo-png.c, function cairoimagesurfacecreatefrompng(). It calls readpng(), where the input filename is parsed, and memory is allocated to hold the resulting surface as follows:

cairo-png.c: readpng() .. pnggetIHDR (png, info, &pngwidth, &pngheight, &depth, &colortype, &interlace, NULL, NULL); .. pixelsize = 4; data = malloc (pngwidth pngheight pixelsize); ..

Note that pngwidth and pngheight come from libpng's IHDR. The image width and height are restricted in libpng's pngconf.h, and by default the restrictions are as follows: # define PNGUSERWIDTHMAX 1000000L # define PNGUSERHEIGHTMAX 1000000L

so any width < 1000000 and height < 1000000 will pass through libpng, allowing an integer overflow in cairo's readpng() function above.

The upstream fix can be found here: http://gitweb.freedesktop.org/?p=cairo;a=commitdiff;h=5c7d2d14d78e4dfb1ef6d2c40f0910f177e07360 http://gitweb.freedesktop.org/?p=cairo;a=commitdiff;h=e49bcde27f88e21d5b8037a0089a226096f6514b