FreeBSD Bugzilla – Attachment 78398 Details for
Bug 112769
[patch] [security] print/freetype2 fix for heap overflow
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
patch-src_truetype_ttgload.c
patch-src_truetype_ttgload.c (text/plain), 920 bytes, created by
Nick Barkas
on 2007-05-18 21:30:03 UTC
(
hide
)
Description:
patch-src_truetype_ttgload.c
Filename:
MIME Type:
Creator:
Nick Barkas
Created:
2007-05-18 21:30:03 UTC
Size:
920 bytes
patch
obsolete
>--- src/truetype/ttgload.c.orig Tue Feb 14 12:44:56 2006 >+++ src/truetype/ttgload.c Fri May 18 13:05:34 2007 >@@ -269,7 +269,11 @@ > > n_points = 0; > if ( n_contours > 0 ) >+ { > n_points = cont[-1] + 1; >+ if ( n_points < 0 ) >+ goto Invalid_Outline; >+ } > > /* note that we will add four phantom points later */ > error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 ); >@@ -677,7 +681,7 @@ > FT_GlyphLoader gloader = loader->gloader; > FT_Error error = TT_Err_Ok; > FT_Outline* outline; >- FT_UInt n_points; >+ FT_Int n_points; > > > outline = &gloader->current.outline; >@@ -704,7 +708,7 @@ > /* Deltas apply to the unscaled data. */ > FT_Vector* deltas; > FT_Memory memory = loader->face->memory; >- FT_UInt i; >+ FT_Int i; > > > error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=78398">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Actions:
View
Attachments on
bug 112769
: 78398