)]}'
{
  "commit": "a71aa86c2bac114fafb6b47f8da02024ecb44fa6",
  "tree": "06b1fb1a673c173fd2f591845333b3578d495f2e",
  "parents": [
    "5e821de8256d01780566b5c8ab7886fae4c93da8"
  ],
  "author": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Mon Oct 19 15:33:05 2026 -0600"
  },
  "committer": {
    "name": "Behdad Esfahbod",
    "email": "behdad@behdad.org",
    "time": "Mon Oct 19 15:40:59 2026 -0600"
  },
  "message": "[wasm] Don\u0027t pass unvalidated guest pointers to host functions\n\nbuffer_set_contents, face_create, and font_set_coords converted guest\narray addresses to native pointers, using nullptr when validation\nfailed, but then handed the result to hb_memcpy(), hb_blob_create(),\nand hb_font_set_var_coords_normalized() unconditionally.  A font wasm\nmodule passing an out-of-range address with a nonzero length made the\nhost copy from NULL.  face_create also dereferenced the blob_t\nparameter without checking it.\n\nFail the call when validation fails.  buffer_set_contents now\nvalidates before resizing the buffer.\n\nTested with the reporter\u0027s PoC fonts: each now traps in the guest with\n\"out of bounds memory access\" instead of faulting in the host.\nmeson test passes on a -Dwasm\u003denabled build.\n\nReported-by: Ostrolab security team\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "64217a041f4ec10ec805c770f5d6229ed3fe8860",
      "old_mode": 33188,
      "old_path": "src/hb-wasm-api-buffer.hh",
      "new_id": "3cf793850706e60ba722c67c6f742f1a473535de",
      "new_mode": 33188,
      "new_path": "src/hb-wasm-api-buffer.hh"
    },
    {
      "type": "modify",
      "old_id": "22e50e9446748c31e6ab2d8d1fa81bba1e024653",
      "old_mode": 33188,
      "old_path": "src/hb-wasm-api-face.hh",
      "new_id": "e48a1d76136a2d356d53e08afe68c07bb672bca8",
      "new_mode": 33188,
      "new_path": "src/hb-wasm-api-face.hh"
    },
    {
      "type": "modify",
      "old_id": "8dbeda0bb44681d5c18c53cc5c3231f8a6572303",
      "old_mode": 33188,
      "old_path": "src/hb-wasm-api-font.hh",
      "new_id": "2767ea3da0db58a71c15668f8fa6d7ecd96996e8",
      "new_mode": 33188,
      "new_path": "src/hb-wasm-api-font.hh"
    }
  ]
}