Skip to content

FIX: reject out-of-range charmap index in FT2Font.set_charmap#31859

Merged
QuLogic merged 1 commit into
matplotlib:mainfrom
arshsmith:ft2font-set-charmap-bounds
Jun 9, 2026
Merged

FIX: reject out-of-range charmap index in FT2Font.set_charmap#31859
QuLogic merged 1 commit into
matplotlib:mainfrom
arshsmith:ft2font-set-charmap-bounds

Conversation

@arshsmith

@arshsmith arshsmith commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

FT2Font.set_charmap(i) validated only the upper bound:

if (i >= face->num_charmaps) {
    throw std::runtime_error("i exceeds the available number of char maps");
}
FT_CHECK(FT_Set_Charmap, face, face->charmaps[i]);
i is a signed int, so any negative value passed the check and was used
to index face->charmaps[i] — an out-of-bounds read. The resulting garbage
FT_CharMap pointer was then dereferenced by FreeType's FT_Set_Charmap
(FT_Get_CMap_Format), crashing the interpreter. A large negative index
(e.g. font.set_charmap(-2000000000)) reads far outside the array and
segfaults outright.

This is reachable directly from the public, documented FT2Font.set_charmap
API with no Python-level guard.

@arshsmith
FIX: reject out-of-range charmap index in FT2Font.set_charmap
2d32ccf 
FT2Font.set_charmap(i) only checked the upper bound (i >= num_charmaps).
A negative i passed the check and was used to index face->charmaps[i],
an out-of-bounds read whose result was then dereferenced by
FT_Set_Charmap, crashing the interpreter (e.g. set_charmap(-1)).

Reject negative indices as well, raising the same RuntimeError already
used for too-large indices. Valid indices in [0, num_charmaps) are
unaffected.
@github-actions

github-actions Bot commented Jun 9, 2026

Copy link
Copy Markdown

Thank you for opening your first PR into Matplotlib!

If you have not heard from us in a week or so, please leave a new comment below and that should bring it to our attention. Most of our reviewers are volunteers and sometimes things fall through the cracks. We also ask that you please finish addressing any review comments on this PR and wait for it to be merged (or closed) before opening a new one, as it can be a valuable learning experience to go through the review process.

You can also join us on discourse chat for real-time discussion.

For details on testing, writing docs, and our review process, please see the developer guide.
Please let us know if (and how) you use AI, it will help us give you better feedback on your PR.

We strive to be a welcoming and open project. Please follow our Code of Conduct.

@arshsmith

arshsmith commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

I used AI tools (Claude and ChatGPT) to help with code navigation, repository research, and understanding the relevant code paths. The investigation, validation, testing, and final code changes were performed and verified manually by me. I understand the change and can answer questions about the implementation and reasoning behind it.

@story645 story645 modified the milestone: v3.11.1 Jun 9, 2026
@QuLogic QuLogic added this to the v3.11.0 milestone Jun 9, 2026
@QuLogic QuLogic merged commit bab3475 into matplotlib:main Jun 9, 2026
42 checks passed
@meeseeksmachine meeseeksmachine mentioned this pull request Jun 9, 2026
Merged
QuLogic added a commit that referenced this pull request Jun 10, 2026
@QuLogic @meeseeksmachine
Backport PR #31859: FIX: reject out-of-range charmap index in FT2Font…
07c43d4 
….set_charmap
QuLogic added a commit that referenced this pull request Jun 10, 2026
@QuLogic
Merge pull request #31864 from meeseeksmachine/auto-backport-of-pr-31…
ab94d45 
…859-on-v3.11.x

Backport PR #31859 on branch v3.11.x (FIX: reject out-of-range charmap index in FT2Font.set_charmap)
@arshsmith arshsmith deleted the ft2font-set-charmap-bounds branch June 10, 2026 09:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@QuLogic QuLogic QuLogic approved these changes

@story645 story645 story645 approved these changes

Assignees

No one assigned

Labels

topic: text/fonts

Projects

None yet

Milestone

v3.11.0

Development

Successfully merging this pull request may close these issues.

3 participants

@arshsmith @QuLogic @story645