This is the tracking bug for FC5 and FC6, please see the blocks list +++ This bug was initially created as a clone of Bug #240200 +++ Victor Stinner discovered an integer overflow bug in the way freetype processed malformed TTF fonts: http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html The patch can be found here: http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=freetype&r1=1.177&r2=1.178 It appears that this flaw will result in a heap overflow condition: flag_limit = flag + n_points; ... while ( flag < flag_limit ) { ... *flag++ = c = FT_NEXT_BYTE( p );
Built freetype-2.2.1-17.fc6
why not 2.3.4??? Do not retard Fedora!!!
No thanks. Every single freetype release since 2.2 have had its own very, very, noisy surprises. I'm sick of it and not going to update FC6's version of freetype.