tigervnc/contrib/packages/rpm/el5/SOURCES/freetype-2.3.11-CVE-2010-2519.patch

--- freetype-2.3.11/src/base/ftobjs.c	2010-07-12 17:03:47.000000000 +0200
+++ freetype-2.3.11/src/base/ftobjs.c	2010-07-12 17:07:06.000000000 +0200
@@ -1526,7 +1526,19 @@
         goto Exit;
       if ( FT_READ_USHORT( flags ) )
         goto Exit;
-      rlen -= 2;                    /* the flags are part of the resource */
+      FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
+                   i, offsets[i], rlen, flags ));
+
+      if ( ( flags >> 8 ) == 0 )        /* Comment, should not be loaded */
+        continue;
+
+      /* the flags are part of the resource, so rlen >= 2.  */
+      /* but some fonts declare rlen = 0 for empty fragment */
+      if ( rlen > 2 )
+        rlen -= 2;
+      else
+        rlen = 0;
+
       if ( ( flags >> 8 ) == type )
         len += rlen;
       else