File bnc619562_CVE-2010-2498.diff of Package freetype2

Overview Repositories Revisions Requests Users Attributes Meta

File bnc619562_CVE-2010-2498.diff of Package freetype2

From 8d22746c9e5af80ff4304aef440986403a5072e2 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Fri, 11 Jun 2010 23:32:20 +0000
Subject: Fix Savannah bug #30106.

Point numbers for FreeType's implementation of hinting masks are
collected before the final number of points of a glyph has been
determined; in particular, the code for handling the `endchar'
opcode can reduce the number of points.

* src/pshinter/pshalgo.c (psh_glyph_find_strong_points): Assure that
`end_point' is not larger than `glyph->num_points'.
---
diff --git a/src/pshinter/pshalgo.c b/src/pshinter/pshalgo.c
index 417dcee..4b08785 100644
--- a/src/pshinter/pshalgo.c
+++ b/src/pshinter/pshalgo.c
@@ -1690,7 +1691,10 @@
     /* process secondary hints to `selected' points */
     if ( num_masks > 1 && glyph->num_points > 0 )
     {
-      first = mask->end_point;
+      /* the `endchar' op can reduce the number of points */
+      first = mask->end_point > glyph->num_points
+                ? glyph->num_points
+                : mask->end_point;
       mask++;
       for ( ; num_masks > 1; num_masks--, mask++ )
       {
@@ -1698,7 +1702,9 @@
         FT_Int   count;
 
 
-        next  = mask->end_point;
+        next  = mask->end_point > glyph->num_points
+                  ? glyph->num_points
+                  : mask->end_point;
         count = next - first;
         if ( count > 0 )
         {
--
cgit v0.8.3.2

Places

File bnc619562_CVE-2010-2498.diff of Package freetype2

Places