search

ColleagueRiley / RFont

Simple-to-use single header modular font rendering library written in C.
zlib License
25 stars 2 forks source link

stb_truetype CVEs? #6

Closed starseeker closed 4 months ago

starseeker commented 4 months ago

If I understand correctly there are a number of internal offsets in the code that don't validate against the overall buffer size, so there isn't any robustness to unsafe data (which is why stb_truetype.h warns users about that in their comments.) I would imagine RFont has the same limitations, since it uses stb_truetype code? If so, I was wondering if there might be any plans to make RFont more robust by adding the offset validations?

ColleagueRiley commented 4 months ago

To be honest with you I don't know anything about that. I don't currently have any plans to do that. Although I may look into it in the future.