You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

freetype-2.3.11-CVE-2011-0226.patch 4.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108
  1. --- freetype-2.3.11/src/psaux/t1decode.c 2009-09-29 19:51:31.000000000 +0200
  2. +++ freetype-2.3.11/src/psaux/t1decode.c 2011-07-20 14:39:24.000000000 +0200
  3. @@ -4,7 +4,7 @@
  4. /* */
  5. /* PostScript Type 1 decoding routines (body). */
  6. /* */
  7. -/* Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
  8. +/* Copyright 2000-2011 by */
  9. /* David Turner, Robert Wilhelm, and Werner Lemberg. */
  10. /* */
  11. /* This file is part of the FreeType project, and may only be used, */
  12. @@ -27,6 +27,8 @@
  13. #include "psauxerr.h"
  14. +/* ensure proper sign extension */
  15. +#define Fix2Int( f ) ( (FT_Int)(FT_Short)( (f) >> 16 ) )
  16. /*************************************************************************/
  17. /* */
  18. @@ -665,7 +667,7 @@
  19. if ( large_int )
  20. FT_TRACE4(( " %ld", value ));
  21. else
  22. - FT_TRACE4(( " %ld", (FT_Int32)( value >> 16 ) ));
  23. + FT_TRACE4(( " %ld", Fix2Int( value ) ));
  24. #endif
  25. *top++ = value;
  26. @@ -687,8 +689,8 @@
  27. top -= 2;
  28. - subr_no = (FT_Int)( top[1] >> 16 );
  29. - arg_cnt = (FT_Int)( top[0] >> 16 );
  30. + subr_no = Fix2Int( top[1] );
  31. + arg_cnt = Fix2Int( top[0] );
  32. /***********************************************************/
  33. /* */
  34. @@ -861,7 +863,7 @@
  35. if ( arg_cnt != 1 || blend == NULL )
  36. goto Unexpected_OtherSubr;
  37. - idx = (FT_Int)( top[0] >> 16 );
  38. + idx = Fix2Int( top[0] );
  39. if ( idx < 0 ||
  40. idx + blend->num_designs > decoder->len_buildchar )
  41. @@ -929,7 +931,7 @@
  42. if ( arg_cnt != 2 || blend == NULL )
  43. goto Unexpected_OtherSubr;
  44. - idx = (FT_Int)( top[1] >> 16 );
  45. + idx = Fix2Int( top[1] );
  46. if ( idx < 0 || (FT_UInt) idx >= decoder->len_buildchar )
  47. goto Unexpected_OtherSubr;
  48. @@ -950,7 +952,7 @@
  49. if ( arg_cnt != 1 || blend == NULL )
  50. goto Unexpected_OtherSubr;
  51. - idx = (FT_Int)( top[0] >> 16 );
  52. + idx = Fix2Int( top[0] );
  53. if ( idx < 0 || (FT_UInt) idx >= decoder->len_buildchar )
  54. goto Unexpected_OtherSubr;
  55. @@ -1008,11 +1010,15 @@
  56. break;
  57. default:
  58. - FT_ERROR(( "t1_decoder_parse_charstrings:"
  59. - " unknown othersubr [%d %d], wish me luck\n",
  60. - arg_cnt, subr_no ));
  61. - unknown_othersubr_result_cnt = arg_cnt;
  62. - break;
  63. + if ( arg_cnt >= 0 && subr_no >= 0 )
  64. + {
  65. + FT_ERROR(( "t1_decoder_parse_charstrings:"
  66. + " unknown othersubr [%d %d], wish me luck\n",
  67. + arg_cnt, subr_no ));
  68. + unknown_othersubr_result_cnt = arg_cnt;
  69. + break;
  70. + }
  71. + /* fall through */
  72. Unexpected_OtherSubr:
  73. FT_ERROR(( "t1_decoder_parse_charstrings:"
  74. @@ -1138,8 +1144,8 @@
  75. top[0],
  76. top[1],
  77. top[2],
  78. - (FT_Int)( top[3] >> 16 ),
  79. - (FT_Int)( top[4] >> 16 ) );
  80. + Fix2Int( top[3] ),
  81. + Fix2Int( top[4] ) );
  82. case op_sbw:
  83. FT_TRACE4(( " sbw" ));
  84. @@ -1313,7 +1319,7 @@
  85. FT_TRACE4(( " callsubr" ));
  86. - idx = (FT_Int)( top[0] >> 16 );
  87. + idx = Fix2Int( top[0] );
  88. if ( idx < 0 || idx >= (FT_Int)decoder->num_subrs )
  89. {
  90. FT_ERROR(( "t1_decoder_parse_charstrings:"