From 8aed4d992db246a537d07862f31dd04698c3f7e2 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Fri, 9 Jan 2026 16:58:23 +0100
Subject: [PATCH] Fix CVE-2025-15275: Heap buffer overflow in SFD image parsing
 (#5721)

From: Ahmet Furkan Kavraz <55850855+ahmetfurkankavraz@users.noreply.github.com>

Fixes: CVE-2025-15275 | ZDI-25-1189 | ZDI-CAN-28543

Co-authored-by: Ahmet Furkan Kavraz <kavraz@amazon.com>

CVE: CVE-2025-15275
Upstream-Status: Backport [https://github.com/fontforge/fontforge/commit/7195402701ace7783753ef9424153eff48c9af44]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 fontforge/sfd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fontforge/sfd.c b/fontforge/sfd.c
index 149941148..e19d3a30f 100644
--- a/fontforge/sfd.c
+++ b/fontforge/sfd.c
@@ -3585,6 +3585,10 @@ static ImageList *SFDGetImage(FILE *sfd) {
     getint(sfd,&image_type);
     getint(sfd,&bpl);
     getint(sfd,&clutlen);
+    if ( clutlen < 0 || clutlen > 256 ) {
+        LogError(_("Invalid clut length %d in sfd file, must be between 0 and 256"), clutlen);
+        return NULL;
+    }
     gethex(sfd,&trans);
     image = GImageCreate(image_type,width,height);
     base = image->list_len==0?image->u.image:image->u.images[0];
