You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

freetype-2.3.11-CVE-2012-1127.patch 1.8KB

12345678910111213141516171819202122232425262728293031323334353637383940414243
  1. --- freetype-2.3.11/src/bdf/bdflib.c 2012-03-28 10:20:31.000000000 +0200
  2. +++ freetype-2.3.11/src/bdf/bdflib.c 2012-03-28 10:22:28.000000000 +0200
  3. @@ -1092,6 +1092,7 @@
  4. #define ACMSG13 "Glyph %ld extra rows removed.\n"
  5. #define ACMSG14 "Glyph %ld extra columns removed.\n"
  6. #define ACMSG15 "Incorrect glyph count: %ld indicated but %ld found.\n"
  7. +#define ACMSG16 "Glyph %ld missing columns padded with zero bits.\n"
  8. /* Error messages. */
  9. #define ERRMSG1 "[line %ld] Missing \"%s\" line.\n"
  10. @@ -1695,18 +1696,31 @@
  11. for ( i = 0; i < nibbles; i++ )
  12. {
  13. c = line[i];
  14. + if ( !c )
  15. + break;
  16. *bp = (FT_Byte)( ( *bp << 4 ) + a2i[c] );
  17. if ( i + 1 < nibbles && ( i & 1 ) )
  18. *++bp = 0;
  19. }
  20. + /* If any line has not enough columns, */
  21. + /* indicate they have been padded with zero bits. */
  22. + if ( i < nibbles &&
  23. + !( p->flags & _BDF_GLYPH_WIDTH_CHECK ) )
  24. + {
  25. + FT_TRACE2(( "_bdf_parse_glyphs: " ACMSG16, glyph->encoding ));
  26. + p->flags |= _BDF_GLYPH_WIDTH_CHECK;
  27. + font->modified = 1;
  28. + }
  29. +
  30. /* Remove possible garbage at the right. */
  31. mask_index = ( glyph->bbx.width * p->font->bpp ) & 7;
  32. if ( glyph->bbx.width )
  33. *bp &= nibble_mask[mask_index];
  34. /* If any line has extra columns, indicate they have been removed. */
  35. - if ( ( line[nibbles] == '0' || a2i[(int)line[nibbles]] != 0 ) &&
  36. + if ( i == nibbles &&
  37. + ( line[nibbles] == '0' || a2i[(int)line[nibbles]] != 0 ) &&
  38. !( p->flags & _BDF_GLYPH_WIDTH_CHECK ) )
  39. {
  40. FT_TRACE2(( "_bdf_parse_glyphs: " ACMSG14, glyph->encoding ));