Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

silnrsi/graphite

              master @ ca8d821
            

Fixes

CVEs

CRITICAL

Peak severity

44.4%

Coverage

Highlights

Out-of-bounds Read: 5 prior fixes. Scrutinize any change in this area.

src/Code.cpp: most-fixed (3 issues). Treat as high-risk during review.

15 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Out-of-bounds Read: Multiple fixes address insufficient bounds checks on glyph and cmap table offsets, allowing crafted fonts to trigger reads beyond buffer boundaries.

Buffer Overflow: Bytecode validation gaps allow overreads and out-of-bounds writes when parsing opcode arguments, a critical path for malicious font execution.

Integer Overflow: The gralloc allocation helper lacked overflow checks on size multiplication, enabling undersized allocations that lead to memory corruption.