A crafted font file can trigger a multi-gigabyte allocation when
parsing GPOS PairPos tables in golang.org/x/image/font/sfnt.
In parsePairPosFormat2, numClass1 and numClass2 are read as uint16
values from the font file and their product is passed unchecked to
source.view. With both values at 65535, the product times 2 reaches
approximately 8 GiB, which OOM-kills the process.
Only the io.ReaderAt path is affected (the []byte path is bounded
by the slice length).
Additionally, makeCachedPairPosGlyph and makeCachedPairPosClass do
not validate that indices derived from the font file fall within the
parsed buffer before indexing, and source.varLenView does not check
for integer overflow when computing the total length.
This was previously reported to the Go security team via
security@golang.org and has been designated for the PUBLIC track.
Fix: validate the class count product against maxTableLength before
allocating, add bounds checks on indices in the PairPos kern
functions, and add an overflow check in varLenView.
A crafted font file can trigger a multi-gigabyte allocation when
parsing GPOS PairPos tables in golang.org/x/image/font/sfnt.
In parsePairPosFormat2, numClass1 and numClass2 are read as uint16
values from the font file and their product is passed unchecked to
source.view. With both values at 65535, the product times 2 reaches
approximately 8 GiB, which OOM-kills the process.
Only the io.ReaderAt path is affected (the []byte path is bounded
by the slice length).
Additionally, makeCachedPairPosGlyph and makeCachedPairPosClass do
not validate that indices derived from the font file fall within the
parsed buffer before indexing, and source.varLenView does not check
for integer overflow when computing the total length.
This was previously reported to the Go security team via
security@golang.org and has been designated for the PUBLIC track.
Fix: validate the class count product against maxTableLength before
allocating, add bounds checks on indices in the PairPos kern
functions, and add an overflow check in varLenView.