You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

freetype-2.3.11-CVE-2012-1140.patch 1.5KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253
  1. --- freetype-2.3.11/src/psaux/psconv.c 2009-07-31 18:45:18.000000000 +0200
  2. +++ freetype-2.3.11/src/psaux/psconv.c 2012-03-28 10:55:16.000000000 +0200
  3. @@ -4,7 +4,7 @@
  4. /* */
  5. /* Some convenience conversions (body). */
  6. /* */
  7. -/* Copyright 2006, 2008, 2009 by */
  8. +/* Copyright 2006, 2008, 2009, 2012 by */
  9. /* David Turner, Robert Wilhelm, and Werner Lemberg. */
  10. /* */
  11. /* This file is part of the FreeType project, and may only be used, */
  12. @@ -79,7 +79,7 @@
  13. FT_Bool sign = 0;
  14. - if ( p == limit || base < 2 || base > 36 )
  15. + if ( p >= limit || base < 2 || base > 36 )
  16. return 0;
  17. if ( *p == '-' || *p == '+' )
  18. @@ -150,7 +150,7 @@
  19. FT_Bool sign = 0;
  20. - if ( p == limit )
  21. + if ( p >= limit )
  22. return 0;
  23. if ( *p == '-' || *p == '+' )
  24. @@ -346,7 +346,11 @@
  25. #if 1
  26. - p = *cursor;
  27. + p = *cursor;
  28. +
  29. + if ( p >= limit )
  30. + return 0;
  31. +
  32. if ( n > (FT_UInt)( limit - p ) )
  33. n = (FT_UInt)( limit - p );
  34. @@ -434,6 +438,10 @@
  35. #if 1
  36. p = *cursor;
  37. +
  38. + if ( p >= limit )
  39. + return 0;
  40. +
  41. if ( n > (FT_UInt)(limit - p) )
  42. n = (FT_UInt)(limit - p);