)]}'
{
  "commit": "a439a61f8faefbb4074494ee126774f8a5aafddc",
  "tree": "538aebe39e492070fe926b8e9f6732442ee1f114",
  "parents": [
    "d75c58a2e4c87903780a75a102cba4df93c5fedc"
  ],
  "author": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:30:40 2026 -0600"
  },
  "committer": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Wed Jul 08 00:30:40 2026 -0600"
  },
  "message": "[vector] Guard base64 output-length overflow in SVG image embedding\n\nhb_vector_buf_t::append_base64() sized its output as\n\n    unsigned out_len \u003d ((len + 2) / 3) * 4;\n\nwhich overflows 32-bit for a very large len (len + 2 wraps, and the * 4\nwraps for len above ~3.2 GB).  len is the attacker-controlled embedded\nPNG length on the vector SVG paint path (hb-vector-paint-svg.cc), so a\nwrapped out_len under-sizes the buffer while the encode loop still writes\n4 bytes per 3 input bytes -- a heap out-of-bounds write.\n\nCompute the group count without the +2 (len / 3 + (len % 3 !\u003d 0)) and use\nhb_unsigned_mul_overflows()/hb_unsigned_add_overflows() so an oversized\ninput fails the allocation instead of wrapping.  resize_full() already\nrejects a size that does not fit in int, so the remaining path is safe.\n\nAssisted-by: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "543cbddd70d653c15b59ccee4e91bfefd0667651",
      "old_mode": 33188,
      "old_path": "src/hb-vector-buf.hh",
      "new_id": "5b2321dec7b0ae41b4f6338d99e6021dcc6d17a9",
      "new_mode": 33188,
      "new_path": "src/hb-vector-buf.hh"
    }
  ]
}