tigervnc/contrib/packages/rpm/el5/SOURCES/freetype-2.3.11-CVE-2010-2520.patch

--- freetype-2.3.11/src/truetype/ttinterp.c	2009-07-31 18:45:19.000000000 +0200
+++ freetype-2.3.11/src/truetype/ttinterp.c	2010-07-15 14:44:23.000000000 +0200
@@ -6466,8 +6466,8 @@
       end_point   = CUR.pts.contours[contour] - CUR.pts.first_point;
       first_point = point;
 
-      if ( CUR.pts.n_points <= end_point )
-        end_point = CUR.pts.n_points;
+      if ( BOUNDS ( end_point, CUR.pts.n_points ) )
+        end_point = CUR.pts.n_points - 1;
 
       while ( point <= end_point && ( CUR.pts.tags[point] & mask ) == 0 )
         point++;