← Back to branch summary

~ubuntu-branches/ubuntu/vivid/freetype/vivid-proposed

« back to all changes in this revision

Viewing changes to debian/patches-freetype/CVE-2014-96xx/CVE-2014-9663.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-02-24 11:28:03 UTC
  • Revision ID: package-import@ubuntu.com-20150224112803-k20pw5pv807q5jcv
Tags: 2.5.2-2ubuntu3
* SECURITY UPDATE: denial of service and possible code execution via
  multiple security issues
  - debian/patches-freetype/CVE-2014-96xx/*.patch: backport a large
    quantity of upstream commits to fix multiple security issues.
  - CVE-2014-9656
  - CVE-2014-9657
  - CVE-2014-9658
  - CVE-2014-9659
  - CVE-2014-9660
  - CVE-2014-9661
  - CVE-2014-9662
  - CVE-2014-9663
  - CVE-2014-9664
  - CVE-2014-9665
  - CVE-2014-9666
  - CVE-2014-9667
  - CVE-2014-9668
  - CVE-2014-9669
  - CVE-2014-9670
  - CVE-2014-9671
  - CVE-2014-9672
  - CVE-2014-9673
  - CVE-2014-9674
  - CVE-2014-9675

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches-freetype/CVE-2014-96xx/CVE-2014-9663.patch
 
1
Backport of:
 
2
 
 
3
From 9bd20b7304aae61de5d50ac359cf27132bafd4c1 Mon Sep 17 00:00:00 2001
 
4
From: Werner Lemberg <wl@gnu.org>
 
5
Date: Sat, 22 Nov 2014 05:24:45 +0000
 
6
Subject: [sfnt] Fix Savannah bug #43656.
 
7
 
 
8
* src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity
 
9
tests.
 
10
---
 
11
Index: freetype-2.5.2/src/sfnt/ttcmap.c
 
12
===================================================================
 
13
--- freetype-2.5.2.orig/src/sfnt/ttcmap.c       2015-02-24 08:21:38.682007970 -0500
 
14
+++ freetype-2.5.2/src/sfnt/ttcmap.c    2015-02-24 08:21:38.678007944 -0500
 
15
@@ -825,9 +825,6 @@
 
16
     FT_Error  error = FT_Err_Ok;
 
17
 
 
18
 
 
19
-    if ( length < 16 )
 
20
-      FT_INVALID_TOO_SHORT;
 
21
-
 
22
     /* in certain fonts, the `length' field is invalid and goes */
 
23
     /* out of bound.  We try to correct this here...            */
 
24
     if ( table + length > valid->limit )
 
25
@@ -838,6 +835,9 @@
 
26
       length = (FT_UInt)( valid->limit - table );
 
27
     }
 
28
 
 
29
+    if ( length < 16 )
 
30
+      FT_INVALID_TOO_SHORT;
 
31
+
 
32
     p        = table + 6;
 
33
     num_segs = TT_NEXT_USHORT( p );   /* read segCountX2 */
 
34