← Back to branch summary

~ubuntu-branches/ubuntu/vivid/freetype/vivid

« back to all changes in this revision

Viewing changes to debian/patches-freetype/CVE-2014-96xx/CVE-2014-9656.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-02-24 11:28:03 UTC
  • Revision ID: package-import@ubuntu.com-20150224112803-k20pw5pv807q5jcv
Tags: 2.5.2-2ubuntu3
* SECURITY UPDATE: denial of service and possible code execution via
  multiple security issues
  - debian/patches-freetype/CVE-2014-96xx/*.patch: backport a large
    quantity of upstream commits to fix multiple security issues.
  - CVE-2014-9656
  - CVE-2014-9657
  - CVE-2014-9658
  - CVE-2014-9659
  - CVE-2014-9660
  - CVE-2014-9661
  - CVE-2014-9662
  - CVE-2014-9663
  - CVE-2014-9664
  - CVE-2014-9665
  - CVE-2014-9666
  - CVE-2014-9667
  - CVE-2014-9668
  - CVE-2014-9669
  - CVE-2014-9670
  - CVE-2014-9671
  - CVE-2014-9672
  - CVE-2014-9673
  - CVE-2014-9674
  - CVE-2014-9675

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches-freetype/CVE-2014-96xx/CVE-2014-9656.patch
 
1
From f0292bb9920aa1dbfed5f53861e7c7a89b35833a Mon Sep 17 00:00:00 2001
 
2
From: Werner Lemberg <wl@gnu.org>
 
3
Date: Mon, 24 Nov 2014 09:51:21 +0000
 
4
Subject: [sfnt] Fix Savannah bug #43680.
 
5
 
 
6
This adds an additional constraint to make the fix from 2013-01-25
 
7
really work.
 
8
 
 
9
* src/sfnt/ttsbit.c (tt_sbit_decoder_load_image) <index_format==4>:
 
10
Check `p' before `num_glyphs'.
 
11
---
 
12
Index: freetype-2.5.2/src/sfnt/ttsbit.c
 
13
===================================================================
 
14
--- freetype-2.5.2.orig/src/sfnt/ttsbit.c       2015-02-24 08:19:30.901177578 -0500
 
15
+++ freetype-2.5.2/src/sfnt/ttsbit.c    2015-02-24 08:19:30.901177578 -0500
 
16
@@ -1143,7 +1143,8 @@
 
17
         num_glyphs = FT_NEXT_ULONG( p );
 
18
 
 
19
         /* overflow check for p + ( num_glyphs + 1 ) * 4 */
 
20
-        if ( num_glyphs > (FT_ULong)( ( ( p_limit - p ) >> 2 ) - 1 ) )
 
21
+        if ( p + 4 > p_limit                                         ||
 
22
+             num_glyphs > (FT_ULong)( ( ( p_limit - p ) >> 2 ) - 1 ) )
 
23
           goto NoBitmap;
 
24
 
 
25
         for ( mm = 0; mm < num_glyphs; mm++ )