File CVE-2012-1139.patch of Package freetype2
From 6ac022dc750d95296a6f731b9594f2e751d997fa Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Thu, 01 Mar 2012 15:43:20 +0000
Subject: [bdf] Fix Savannah bug #35656.
* src/bdf/bdflib.c (_bdf_parse_glyphs) <_BDF_BITMAP>: Check validity
of nibble characters instead of accessing `a2i' array.
---
---
src/bdf/bdflib.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
Index: freetype-2.4.4/src/bdf/bdflib.c
===================================================================
--- freetype-2.4.4.orig/src/bdf/bdflib.c
+++ freetype-2.4.4/src/bdf/bdflib.c
@@ -1707,7 +1707,7 @@
for ( i = 0; i < nibbles; i++ )
{
c = line[i];
- if ( !c )
+ if ( !isdigok( hdigits, c ) )
break;
*bp = (FT_Byte)( ( *bp << 4 ) + a2i[c] );
if ( i + 1 < nibbles && ( i & 1 ) )
@@ -1730,9 +1730,9 @@
*bp &= nibble_mask[mask_index];
/* If any line has extra columns, indicate they have been removed. */
- if ( i == nibbles &&
- ( line[nibbles] == '0' || a2i[(int)line[nibbles]] != 0 ) &&
- !( p->flags & _BDF_GLYPH_WIDTH_CHECK ) )
+ if ( i == nibbles &&
+ isdigok( hdigits, line[nibbles] ) &&
+ !( p->flags & _BDF_GLYPH_WIDTH_CHECK ) )
{
FT_TRACE2(( "_bdf_parse_glyphs: " ACMSG14, glyph->encoding ));
p->flags |= _BDF_GLYPH_WIDTH_CHECK;