Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.2:Test
ft2demos
bnc619562_CVE-2010-2519.diff
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File bnc619562_CVE-2010-2519.diff of Package ft2demos
From 5ef20c8c1d4de12a84b50ba497c2a358c90ec44b Mon Sep 17 00:00:00 2001 From: suzuki toshiya <sssa@flavor1.ipc.hiroshima-u.ac.jp> Date: Thu, 01 Jul 2010 09:39:04 +0000 Subject: Initial fix for Savannah bug #30306. * src/base/ftobjs.c (Mac_Read_POST_Resource): Check `rlen' the length of fragment declared in the POST fragment header and prevent an underflow in length calculation. Some fonts set the length to zero in spite of the exist of following 16bit `type'. Reported by Robert Swiecki. --- --- src/base/ftobjs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) Index: freetype-2.3.9/src/base/ftobjs.c =================================================================== --- freetype-2.3.9.orig/src/base/ftobjs.c +++ freetype-2.3.9/src/base/ftobjs.c @@ -1520,7 +1520,19 @@ goto Exit; if ( FT_READ_USHORT( flags ) ) goto Exit; - rlen -= 2; /* the flags are part of the resource */ + FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n", + i, offsets[i], rlen, flags )); + + if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */ + continue; + + /* the flags are part of the resource, so rlen >= 2. */ + /* but some fonts declare rlen = 0 for empty fragment */ + if ( rlen > 2 ) + rlen -= 2; + else + rlen = 0; + if ( ( flags >> 8 ) == type ) len += rlen; else
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor