mirrors
/
tigervnc
mirror of https://github.com/TigerVNC/tigervnc.git
Watch 1
Star 0
Fork 0
Code Issues 0 Releases 37 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2547 Commits
15 Branches
Tree: 1ff04d1b8a
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '1ff04d1b8a'
${ noResults }
tigervnc/contrib/packages/rpm/el5/SOURCES/freetype-2.3.11-CVE-2010-24...

freetype-2.3.11-CVE-2010-2499.patch 1.2KB
Raw Blame History

123456789101112131415161718192021222324252627282930313233343536373839 
  1. --- freetype-2.3.11/src/base/ftobjs.c	2009-09-02 08:42:41.000000000 +0200

  2. +++ freetype-2.3.11/src/base/ftobjs.c	2010-07-12 16:39:13.000000000 +0200

  3. @@ -1531,6 +1531,8 @@

  4.          len += rlen;

  5.        else

  6.        {

  7. +        if ( pfb_lenpos + 3 > pfb_len + 2 )

  8. +          goto Exit2;

  9.          pfb_data[pfb_lenpos    ] = (FT_Byte)( len );

  10.          pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );

  11.          pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );

  12. @@ -1539,6 +1541,8 @@

  13.          if ( ( flags >> 8 ) == 5 )      /* End of font mark */

  14.            break;

  15.  

  16. +        if ( pfb_pos + 6 > pfb_len + 2 )

  17. +          goto Exit2;

  18.          pfb_data[pfb_pos++] = 0x80;

  19.  

  20.          type = flags >> 8;

  21. @@ -1553,12 +1557,18 @@

  22.        }

  23.  

  24.        error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );

  25. +      if ( error )

  26. +        goto Exit2;

  27.        pfb_pos += rlen;

  28.      }

  29.  

  30. +    if ( pfb_pos + 2 > pfb_len + 2 )

  31. +      goto Exit2;

  32.      pfb_data[pfb_pos++] = 0x80;

  33.      pfb_data[pfb_pos++] = 3;

  34.  

  35. +    if ( pfb_lenpos + 3 > pfb_len + 2 )

  36. +      goto Exit2;

  37.      pfb_data[pfb_lenpos    ] = (FT_Byte)( len );

  38.      pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );

  39.      pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );