Attachment 309698 Details for Bug 450773 – freetype2 security fixes backported to freetype1

[patch] freetype2 security fixes backported to freetype1

freetype-1.4pre-CVE-2008-1808.patch (text/plain), 2.53 KB, created by Hans de Goede on 2008-06-18 06:56:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hans de Goede

Created: 2008-06-18 06:56:49 UTC

Size: 2.53 KB

patch

obsolete

>diff -up freetype-1.3.1/lib/ttfile.c~ freetype-1.3.1/lib/ttfile.c
>--- freetype-1.3.1/lib/ttfile.c~	2008-06-14 09:51:56.000000000 +0200
>+++ freetype-1.3.1/lib/ttfile.c	2008-06-14 09:51:56.000000000 +0200
>@@ -931,6 +931,9 @@
>   EXPORT_FUNC
>   TT_Error  TT_Skip_File( STREAM_ARGS Long  distance )
>   {
>+    if ( distance < 0 )
>+      return TT_Err_Invalid_File_Offset;
>+
>     return TT_Seek_File( STREAM_VARS ftell( CUR_Stream->file ) -
>                                      CUR_Stream->base + distance );
>   }
>diff -up freetype-1.3.1/lib/ttinterp.c~ freetype-1.3.1/lib/ttinterp.c
>--- freetype-1.3.1/lib/ttinterp.c~	2008-06-14 09:56:48.000000000 +0200
>+++ freetype-1.3.1/lib/ttinterp.c	2008-06-14 09:56:48.000000000 +0200
>@@ -4144,7 +4144,7 @@
> 
>     /* XXX: this is probably wrong... at least it prevents memory */
>     /*      corruption when zp2 is the twilight zone              */
>-    if ( last_point > CUR.zp2.n_points )
>+    if ( BOUNDS ( last_point , CUR.zp2.n_points ) )
>     {
>       if ( CUR.zp2.n_points > 0 )
>         last_point = CUR.zp2.n_points - 1;
>diff -up freetype-1.3.1/lib/ttload.c~ freetype-1.3.1/lib/ttload.c
>--- freetype-1.3.1/lib/ttload.c~	2008-06-14 09:37:02.000000000 +0200
>+++ freetype-1.3.1/lib/ttload.c	2008-06-14 09:46:33.000000000 +0200
>@@ -284,6 +284,12 @@
> 
>     /* read frame data into face table */
>     maxProfile->version               = GET_ULong();
>+    
>+    if (maxProfile->version < 0x10000L)
>+    {
>+      PERROR(( "!! invalid file format" ));
>+      return TT_Err_Invalid_File_Format;
>+    }
> 
>     maxProfile->numGlyphs             = GET_UShort();
> 
>@@ -294,6 +300,14 @@
> 
>     maxProfile->maxZones              = GET_UShort();
>     maxProfile->maxTwilightPoints     = GET_UShort();
>+    /* we add 4 phantom points later */
>+    if ( maxProfile->maxTwilightPoints > ( 0xFFFFU - 4 ) )
>+    {
>+      PERROR(( "Too much twilight points in `maxp' table;\n" ));
>+      PERROR(( "  some glyphs might be rendered incorrectly.\n" ));
>+ 
>+      maxProfile->maxTwilightPoints = 0xFFFFU - 4;
>+    }
> 
>     maxProfile->maxStorage            = GET_UShort();
>     maxProfile->maxFunctionDefs       = GET_UShort();
>@@ -330,8 +344,10 @@
>      
>     /* We also increase maxPoints and maxContours in order to support */
>     /* some broken fonts.                                             */
>-    face->maxPoints   += 8;
>-    face->maxContours += 4;
>+    if ( face->maxPoints < ( 0xFFFFU - 8 ) )
>+      face->maxPoints   += 8;
>+    if ( face->maxContours < ( 0xFFFFU - 4 ) )
>+      face->maxContours += 4;
> 
>     PTRACE2(( "GASP loaded.\n" ));
>     return TT_Err_Ok;

Actions: View | Diff

Attachments on bug 450773: 309698