SIGN IN SIGN UP

Fix stack overflow vulnerability in gray_render_cubic

Add a bounds check before gray_split_cubic(). Function uses bez_stack[32*3+1]
as an arc stack, advancing arc by 3 on each split. When arc reaches offset
(93), the write to arc[6] at index 99 exceeds the array boundary (max index 96)

A malicious Lottie file with wrong cubic curve could trigger this overflow.
M
Michal Szczecinski committed
9e4f354f6ebdf294738ef7abf1728f40889c2c51
Parent: 671c561
Committed by JoogabYun <40262755+JoogabYun@users.noreply.github.com> on 5/12/2026, 12:35:45 AM