You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

freetype-2.3.11-CVE-2012-1132.patch 4.6KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130
  1. --- freetype-2.3.11/src/psaux/psobjs.c 2009-07-31 18:45:18.000000000 +0200
  2. +++ freetype-2.3.11/src/psaux/psobjs.c 2012-04-03 13:14:05.000000000 +0200
  3. @@ -4,7 +4,7 @@
  4. /* */
  5. /* Auxiliary functions for PostScript fonts (body). */
  6. /* */
  7. -/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
  8. +/* Copyright 1996-2012 by */
  9. /* David Turner, Robert Wilhelm, and Werner Lemberg. */
  10. /* */
  11. /* This file is part of the FreeType project, and may only be used, */
  12. @@ -589,7 +589,7 @@
  13. }
  14. Exit:
  15. - if ( cur == parser->cursor )
  16. + if ( cur < limit && cur == parser->cursor )
  17. {
  18. FT_ERROR(( "ps_parser_skip_PS_token:"
  19. " current token is `%c' which is self-delimiting\n"
  20. --- freetype-2.3.11/src/type1/t1load.c 2009-09-01 08:07:32.000000000 +0200
  21. +++ freetype-2.3.11/src/type1/t1load.c 2012-04-03 13:14:30.000000000 +0200
  22. @@ -71,6 +71,13 @@
  23. #include "t1errors.h"
  24. +#ifdef FT_CONFIG_OPTION_INCREMENTAL
  25. +#define IS_INCREMENTAL ( face->root.internal->incremental_interface != 0 )
  26. +#else
  27. +#define IS_INCREMENTAL 0
  28. +#endif
  29. +
  30. +
  31. /*************************************************************************/
  32. /* */
  33. /* The macro FT_COMPONENT is used in trace mode. It is an implicit */
  34. @@ -1027,7 +1034,8 @@
  35. static int
  36. read_binary_data( T1_Parser parser,
  37. FT_Long* size,
  38. - FT_Byte** base )
  39. + FT_Byte** base,
  40. + FT_Bool incremental )
  41. {
  42. FT_Byte* cur;
  43. FT_Byte* limit = parser->root.limit;
  44. @@ -1057,8 +1065,12 @@
  45. return !parser->root.error;
  46. }
  47. - FT_ERROR(( "read_binary_data: invalid size field\n" ));
  48. - parser->root.error = T1_Err_Invalid_File_Format;
  49. + if( !incremental )
  50. + {
  51. + FT_ERROR(( "read_binary_data: invalid size field\n" ));
  52. + parser->root.error = T1_Err_Invalid_File_Format;
  53. + }
  54. +
  55. return 0;
  56. }
  57. @@ -1379,15 +1391,17 @@
  58. FT_Byte* base;
  59. - /* If the next token isn't `dup' we are done. */
  60. - if ( ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
  61. + /* If we are out of data, or if the next token isn't `dup', */
  62. + /* we are done. */
  63. + if ( parser->root.cursor + 4 >= parser->root.limit ||
  64. + ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
  65. break;
  66. T1_Skip_PS_Token( parser ); /* `dup' */
  67. idx = T1_ToInt( parser );
  68. - if ( !read_binary_data( parser, &size, &base ) )
  69. + if ( !read_binary_data( parser, &size, &base, IS_INCREMENTAL ) )
  70. return;
  71. /* The binary string is followed by one token, e.g. `NP' */
  72. @@ -1399,7 +1413,8 @@
  73. return;
  74. T1_Skip_Spaces ( parser );
  75. - if ( ft_strncmp( (char*)parser->root.cursor, "put", 3 ) == 0 )
  76. + if ( parser->root.cursor + 4 < parser->root.limit &&
  77. + ft_strncmp( (char*)parser->root.cursor, "put", 3 ) == 0 )
  78. {
  79. T1_Skip_PS_Token( parser ); /* skip `put' */
  80. T1_Skip_Spaces ( parser );
  81. @@ -1572,7 +1587,7 @@
  82. cur++; /* skip `/' */
  83. len = parser->root.cursor - cur;
  84. - if ( !read_binary_data( parser, &size, &base ) )
  85. + if ( !read_binary_data( parser, &size, &base, IS_INCREMENTAL ) )
  86. return;
  87. /* for some non-standard fonts like `Optima' which provides */
  88. @@ -1861,7 +1876,7 @@
  89. parser->root.cursor = start_binary;
  90. - if ( !read_binary_data( parser, &s, &b ) )
  91. + if ( !read_binary_data( parser, &s, &b, IS_INCREMENTAL ) )
  92. return T1_Err_Invalid_File_Format;
  93. have_integer = 0;
  94. }
  95. @@ -1874,7 +1889,7 @@
  96. parser->root.cursor = start_binary;
  97. - if ( !read_binary_data( parser, &s, &b ) )
  98. + if ( !read_binary_data( parser, &s, &b, IS_INCREMENTAL ) )
  99. return T1_Err_Invalid_File_Format;
  100. have_integer = 0;
  101. }
  102. @@ -2148,9 +2163,7 @@
  103. type1->subrs_len = loader.subrs.lengths;
  104. }
  105. -#ifdef FT_CONFIG_OPTION_INCREMENTAL
  106. - if ( !face->root.internal->incremental_interface )
  107. -#endif
  108. + if ( !IS_INCREMENTAL )
  109. if ( !loader.charstrings.init )
  110. {
  111. FT_ERROR(( "T1_Open_Face: no `/CharStrings' array in face\n" ));