[himgoyalmicro]

Fixes #11632 #11631

Description

Fixes the potential Overflow issues in WPF native code

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR addresses multiple potential integer-overflow and out-of-bounds scenarios across WPF native components (WpfGfx, PenImc, DirectWriteForwarder/TtfDelta), and introduces AppContext-controlled “opt-out” switches to preserve backward behavior when required.

Changes:

• Adds overflow-safe arithmetic and additional bounds validations around texture sizing, buffer offsets, and palette indexing in native code paths.
• Introduces new native/managed switches (WpfGfx, PenImc, TtfDelta) to disable the added bounds-check protections if necessary.
• Hardens the DirectWriteForwarder TrueType subsetter (TtfDelta) with widespread allocation/offset overflow checks guarded by the new switch.

Reviewed changes

Copilot reviewed 35 out of 36 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/glyphrunslave.cpp	Adds overflow-checked texture size computations for glyph alpha map realization.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/hw/hwbitmapcolorsource.cpp	Uses overflow-safe offset math and buffer-size validation before CopyPixels/self-copy operations.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/hw/d3dglyphbank.cpp	Uses 64-bit arithmetic for src pointer/row calculations to avoid overflow.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/dll/wpfgfx.def	Exports a new native entry point to control bounds-check protection.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/common/gradienttexture.cpp	Whitespace-only change.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/common/engine.cpp	Removes trailing blank lines.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/shared/WpfGfxSwitches.h	Adds a native switch holder for WpfGfx bounds-check mitigation (missing standard license header).
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/shared/WpfGfxSwitches.cpp	Implements WpfGfx switch storage and exported setter.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/shared/shared.vcxproj	Includes WpfGfxSwitches.cpp in the shared project build.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/shared/shared.h	Ensures WpfGfxSwitches.h is included for consumers.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/shared/dynarray.h	Uses FreAssert vs Assert in First/Last based on the WpfGfx mitigation switch.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/scanop/soconvert.cpp	Adds palette bounds protections gated by the WpfGfx mitigation switch.
src/Microsoft.DotNet.Wpf/src/WpfGfx/common/effects/effectlist.cpp	Adds offset+size bounds validation when returning effect parameter blocks.
src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/UnsafeNativeMethodsMilCoreApi.cs	Adds P/Invoke for WpfGfx bounds-check switch setter.
src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/MediaSystem.cs	Passes the WpfGfx bounds-check mitigation switch to native at startup.
src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/Win32/UnsafeNativeMethodsPenimc.cs	Adds PenImc P/Invoke and forwards AppContext mitigation switch during activation.
src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/CoreAppContextSwitches.cs	Adds AppContext switch definitions for DWF, PenImc, and WpfGfx mitigations.
src/Microsoft.DotNet.Wpf/src/PenImc/dll/PimcTablet.cpp	Adds upper bounds on COM-reported counts; adds null-guard in IsPropertySupported when mitigation enabled.
src/Microsoft.DotNet.Wpf/src/PenImc/dll/PimcContext.cpp	Uses overflow-safe doubling for packet buffer sizing when mitigation enabled.
src/Microsoft.DotNet.Wpf/src/PenImc/dll/PenImcSwitches.h	Adds a native switch holder for PenImc bounds-check mitigation (missing standard license header).
src/Microsoft.DotNet.Wpf/src/PenImc/dll/PenImc.def	Exports PenImc switch setter (PRIVATE).
src/Microsoft.DotNet.Wpf/src/PenImc/dll/PenImc.cpp	Implements PenImc switch storage and exported setter.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/main.cpp	Defines the DWF/TtfDelta global “safe checks enabled” flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttftable.cpp	Adds allocation overflow checks and additional bounds checks (incl. negative index check) behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttftabl1.cpp	Adds overflow checks for read offsets behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttfdelta.cpp	Adds overflow-safe size calculations; changes CalcOutputBufferSize to return error code when safety enabled.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttfacc.cpp	Adds parameter validation and overflow-safe offset/size computations behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttf_safe_checks.h	Introduces the DWF/TtfDelta safety flag helper macro and extern.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modtable.cpp	Adds overflow-safe allocations and offset checks behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modsbit.cpp	Adds extensive EBDT bounds checking and safer realloc/offset math behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modglyf.cpp	Adds overflow-safe allocation and offset computations for glyf/loca operations behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modcmap.cpp	Adds overflow-safe allocations and guards against empty glyph-map access when safety enabled.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/makeglst.cpp	Adds overflow-safe allocations for symbol list/loca/components behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/intsafe_private_copy.h	Adds uint32 convenience wrappers for overflow-safe helpers.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/automap.cpp	Adds overflow checks and bounds validation for GSUB/JSTF parsing behind the safety flag.
src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/truetype.cpp	Initializes the safety flag from AppContext and adds size validations before allocating managed arrays.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dipeshmsft]

Ran the script to verify the changes with fixes in 8.0 and 9.0. There are no extra changes. LGTM.

[dipeshmsft]

LGTM

[harshit7962]

LGTM

[JeppeJepsen]

This PR causes a functional regression:
GlyphTypeface.ComputeSubset now rejects stock Windows fonts (Calibri, Cambria,Constantia, Corbel), breaking all XPS/PDF export that uses them.

Filed as #11834 with a minimal repro and a DEVPATH A/B isolating it to PresentationCore 4.8.9032.0 → 4.8.9344.0.

#11834 also documents that Switch.MS.Internal.TtfDelta.DisableDirectWriteForwarderBoundsCheckProtection has no effect, so the intended opt-out for this mitigation is currently unusable.

[JeppeJepsen]

Following up on my comment above with the root cause, and a second affected platform.

Recap: since this PR shipped, GlyphTypeface.ComputeSubset rejects stock Windows fonts (Calibri, Cambria, Constantia, Corbel - 15 faces), breaking XPS export, XPS-based PDF export and printing. Tracked as #11834.

Root cause: the legacy kern table's uint16 length field has wrapped. The kern subtable header stores its own length in a uint16 (max 65,535), while the table directory stores the real length in a uint32. For calibrib.ttf the directory says 160,164 bytes, so the header field at kern+6 reads 29,088 (160,164 mod 65,536). The new bounds validation sees the inconsistency and rejects the entire font.

Correlation across 25 fonts is exact - all 15 faces whose kern table exceeds 65,535 bytes fail, all 10 that stay under it succeed. Calibri Light passes while Calibri Regular and Bold fail on the same machine, in the same process, for this reason alone.

DirectWrite ignores the kern table entirely and kerns from GPOS, so these fonts render correctly and always have - the table has been inconsistent for years without consequence.

Suggested fix: an inconsistent legacy kern subtable should cause that optional table to be skipped or truncated, not the whole font to be rejected. I verified that stripping only kern restores subsetting for all 15 affected faces, with no visual or metric change and no missing glyphs.

Also affects .NET Framework. The equivalent change shipped as KB5120708 on 2026-08-11 (https://support.microsoft.com/help/5120708); PresentationCore.dll 4.8.9344.0 fails where 4.8.9032.0 succeeds, same font and same code. Since this repo does not service .NET Framework, I filed that separately at https://developercommunity.visualstudio.com/t/KB5120708:-GlyphTypefaceComputeSubset-r/11134941.
Both forks will need the fix.