Bug 2515520

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using    num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits.    When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.