File bnc485889-overflow2.patch of Package ft2demos

From 0a05ba257b6ddd87dacf8d54b626e4b360e0a596 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Fri, 20 Mar 2009 06:19:45 +0000
Subject: Protect against malformed compressed data.

Problem reported by Tavis Ormandy <taviso@google.com>.

* src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is
zero.
---
---
 src/lzw/ftzopen.c |    3 +++
 1 file changed, 3 insertions(+)

Index: freetype-2.3.9/src/lzw/ftzopen.c
===================================================================
--- freetype-2.3.9.orig/src/lzw/ftzopen.c
+++ freetype-2.3.9/src/lzw/ftzopen.c
@@ -332,6 +332,9 @@
 
           while ( code >= 256U )
           {
+            if ( !state->prefix )
+              goto Eof;
+
             FTLZW_STACK_PUSH( state->suffix[code - 256] );
             code = state->prefix[code - 256];
           }