tigervnc/contrib/packages/rpm/el5/SOURCES/freetype-2.3.11-bdf-overflow.patch

--- freetype-2.3.11/src/bdf/bdflib.c	2012-04-02 16:24:56.000000000 +0200
+++ freetype-2.3.11/src/bdf/bdflib.c	2012-04-02 16:25:33.000000000 +0200
@@ -1870,7 +1870,7 @@
       glyph->bpr   = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3;
 
       bitmap_size = glyph->bpr * glyph->bbx.height;
-      if ( bitmap_size > 0xFFFFU )
+      if ( glyph->bpr > 0xFFFFU || bitmap_size > 0xFFFFU )
       {
         FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG4, lineno ));
         error = BDF_Err_Bbx_Too_Big;