On 1/13/26 06:34, Vincent Lefevre wrote: On 2026-01-12 23:33:37 -0600, Jacob Bachmeyer wrote: The issue reported here is a write to address zero causing SIGSEGV. I doubt that compilers can optimize placement new to avoid writing through the given pointer without introducing undefined behavior in correct programs, since the contents of allocated-but-not-initialized memory are undefined. Perhaps in the case of HarfBuzz. But this is not necessarily the case everywhere. Consider the following code:
------------------------------------------------------------ #include <stdio.h> #include <stdlib.h>
attribute((noipa)) // imagine it in a separate TU int ptest (int p) { return p != 0; }
int main (void) { int p = malloc (99999999999); int r = ptest (p); p[0] = 12345; free (p); printf ("%d\n", r); return 0; } ------------------------------------------------------------
On my machine, with GCC and optimizations (e.g. -O), the output is 0 while such a value could be regarded as impossible by the program Due to optimizations, one cannot rely on a crash if the memory could not be allocated. So a more complex program would continue with inconsistent information.
-- Jacob
On 1/10/26 19:54, Alan Coopersmith wrote: advises: HarfBuzz Null Pointer Dereference Vulnerability Report ======================================================
[...]
2. Vulnerability Description and Impact
Description -----------
A null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh:1672-1673. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at the returned pointer address.
When hbmalloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault.
Impact ------ DoS can be triggered.
3. Scenario
The function prototype is as follows:
// src/hb-ot-cmap-table.hh:1669-1675 static SubtableUnicodesCache create (hbblobptrt<cmap> sourcetable) { SubtableUnicodesCache cache = new (cache) SubtableUnicodesCache (sourcetable); return cache; }
[...] [...]
5. Result
Segmentation Fault occurs. [...] Analysis
Error Type: SEGV (Segmentation Violation) Access Address: 0x000000000000 (null pointer) Access Type: WRITE (write access) Occurrence Location: hb-ot-cmap-table.hh:1692 (inside constructor) Root Cause Location: hb-ot-cmap-table.hh:1673 (missing null check) [...] Severity: Moderate 5.3 / 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE ID: CVE-2026-22693 The fix is listed as: claiming "This issue has been patched in version 12.3.0."
Are we now using CVE IDs as some kind of global bug tracker?
-- Jacob
https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww advises: HarfBuzz Null Pointer Dereference Vulnerability Report ======================================================
Summary ------- Affected Version: HarfBuzz 12.3.0 (earlier versions may also be affected) CWE: CWE-476 (NULL Pointer Dereference) Impact: DoS (Denial of Service) Vulnerable Function: OT::SubtableUnicodesCache::create() Vulnerable File: src/hb-ot-cmap-table.hh:1672-1673
1. Background
This vulnerability occurs in the SubtableUnicodesCache::create function executed by hbsubsetpreprocess. This function generates accelerator data for the cmap table to improve font subsetting performance.
HarfBuzz uses failing-alloc.c to simulate memory allocation failures in fuzzing environments. This file overrides the hbmallocimpl function to return NULL with a probability of 1/16:
void hbmallocimpl (sizet size) { return (fastrand () % 16) ? malloc (size) : NULL; }
2. Vulnerability Description and Impact
Description -----------
A null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh:1672-1673. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at the returned pointer address.
When hbmalloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault.
Impact ------ DoS can be triggered.
3. Scenario
The function prototype is as follows:
// src/hb-ot-cmap-table.hh:1669-1675 static SubtableUnicodesCache create (hbblobptrt<cmap> sourcetable) { SubtableUnicodesCache cache = (SubtableUnicodesCache) hbmalloc (sizeof(SubtableUnicodesCache)); new (cache) SubtableUnicodesCache (sourcetable); return cache; }
The vulnerable part is:
SubtableUnicodesCache cache = (SubtableUnicodesCache) hbmalloc (sizeof(SubtableUnicodesCache)); new (cache) SubtableUnicodesCache (sourcetable);
The types of each operand are:
hb-ot-cmap-table.hh:
static SubtableUnicodesCache create (hbblobptrt<cmap> sourcetable)
hb.hh:
void hbmalloc (sizet size);
Although all operands are pointer types, there is no null check for the return value of hbmalloc, causing placement new to be executed on a null pointer.
4. How to Reproduce [see https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww for PoC code & instructions] 5. Result
Segmentation Fault occurs. Crash Output
AddressSanitizer:DEADLYSIGNAL ================================================================= ==25681==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x59ca4a8f5616 bp 0x7ffea8bd7890 sp 0x7ffea8bd7870 T0) ==25681==The signal is caused by a WRITE memory access. ==25681==Hint: address points to the zero page. #0 0x59ca4a8f5616 in OT::SubtableUnicodesCache::SubtableUnicodesCache(hbblobptrt<OT::cmap>) /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-ot-cmap-table.hh:1692:9 #1 0x59ca4a8f5616 in OT::SubtableUnicodesCache::create(hbblobptrt<OT::cmap>) /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-ot-cmap-table.hh:1673:17 #2 0x59ca4a8f3eee in OT::cmap::createfilledcache(hbblobptrt<OT::cmap>) /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-ot-cmap-table.hh:1765:36 #3 0x59ca4a857f6b in attachacceleratordata(hbsubsetplant, hbfacet) /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-subset.cc:322:23 #4 0x59ca4a857f6b in hbsubsetplanexecuteorfail /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-subset.cc:447:5 #5 0x59ca4a853c87 in hbsubsetorfail /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-subset.cc:359:24 #6 0x59ca4a84e051 in hbsubsetpreprocess /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-subset-input.cc:776:27 #7 0x59ca4a2cc51c in testpipeline(unsigned char const, unsigned long, char const) /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../test/fuzzing/repro.cc:126:25 #8 0x59ca4a2cc51c in main /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../test/fuzzing/repro.cc:379:16 #9 0x73592862a1c9 in libcstartcallmain csu/../sysdeps/nptl/libcstartcallmain.h:58:16 #10 0x73592862a28a in libcstartmain csu/../csu/libc-start.c:360:3 #11 0x59ca4a1eff44 in start (/home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/test/fuzzing/repro+0x7f6f44) (BuildId: c0ff5896dd1a71d20ba3d34e75d13dd1ee110590)
AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/wjddn0623/KnightsFrontier/fuzzing/harfbuzz/fuzzbuild/../src/hb-ot-cmap-table.hh:1692:9 in OT::SubtableUnicodesCache::SubtableUnicodesCache(hbblobptrt<OT::cmap>) ==25681==ABORTING
Analysis
Error Type: SEGV (Segmentation Violation) Access Address: 0x000000000000 (null pointer) Access Type: WRITE (write access) Occurrence Location: hb-ot-cmap-table.hh:1692 (inside constructor) Root Cause Location: hb-ot-cmap-table.hh:1673 (missing null check) [see https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww for screenshots] Credit ------ HSPACE Knights Frontier
Reporter : JungWoo Park(with contributions from WooJin Won, HyunYeong Yoo)
JungWooJJING(@JungWooJJING) JungWoo Park of SSA Lab Github : JungWooJJING e-mail : [cuby5577 () gmail com]
wonwoojin Github : @woozhin e-mail : [woonwoojin5 () gmail com]
yhy Github : @ttuurrnn e-mail : [dbgusdud5493 () gmail com]
Severity: Moderate 5.3 / 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE ID: CVE-2026-22693 The fix is listed as: https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae which was merged yesterday, weeks after the 12.3.0 release, despite the CVE record claiming "This issue has been patched in version 12.3.0."
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at the returned pointer address. When hbmalloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.