← Back to branch summary

~ubuntu-branches/ubuntu/vivid/freetype/vivid

« back to all changes in this revision

Viewing changes to debian/patches-freetype/CVE-2014-96xx/CVE-2014-9659-1.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-02-24 11:28:03 UTC
  • Revision ID: package-import@ubuntu.com-20150224112803-k20pw5pv807q5jcv
Tags: 2.5.2-2ubuntu3
* SECURITY UPDATE: denial of service and possible code execution via
  multiple security issues
  - debian/patches-freetype/CVE-2014-96xx/*.patch: backport a large
    quantity of upstream commits to fix multiple security issues.
  - CVE-2014-9656
  - CVE-2014-9657
  - CVE-2014-9658
  - CVE-2014-9659
  - CVE-2014-9660
  - CVE-2014-9661
  - CVE-2014-9662
  - CVE-2014-9663
  - CVE-2014-9664
  - CVE-2014-9665
  - CVE-2014-9666
  - CVE-2014-9667
  - CVE-2014-9668
  - CVE-2014-9669
  - CVE-2014-9670
  - CVE-2014-9671
  - CVE-2014-9672
  - CVE-2014-9673
  - CVE-2014-9674
  - CVE-2014-9675

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches-freetype/CVE-2014-96xx/CVE-2014-9659-1.patch
 
1
From 2cdc4562f873237f1c77d43540537c7a721d3fd8 Mon Sep 17 00:00:00 2001
 
2
From: Dave Arnold <darnold@adobe.com>
 
3
Date: Thu, 04 Dec 2014 05:10:16 +0000
 
4
Subject: [cff] Fix Savannah bug #43661.
 
5
 
 
6
* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdHSTEM,
 
7
cf2_cmdVSTEM, cf2_cmdHINTMASK>: Don't append to stem arrays after
 
8
hintmask is constructed.
 
9
 
 
10
* src/cff/cf2hints.c (cf2_hintmap_build): Add defensive code to
 
11
avoid reading past end of hintmask.
 
12
---
 
13
diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c
 
14
index 81049f4..28a892b 100644
 
15
--- a/src/cff/cf2hints.c
 
16
+++ b/src/cff/cf2hints.c
 
17
@@ -794,9 +794,12 @@
 
18
     maskPtr      = cf2_hintmask_getMaskPtr( &tempHintMask );
 
19
 
 
20
     /* use the hStem hints only, which are first in the mask */
 
21
-    /* TODO: compare this to cffhintmaskGetBitCount */
 
22
     bitCount = cf2_arrstack_size( hStemHintArray );
 
23
 
 
24
+    /* Defense-in-depth.  Should never return here. */
 
25
+    if ( bitCount > hintMask->bitCount )
 
26
+        return;
 
27
+
 
28
     /* synthetic embox hints get highest priority */
 
29
     if ( font->blues.doEmBoxHints )
 
30
     {
 
31
diff --git a/src/cff/cf2intrp.c b/src/cff/cf2intrp.c
 
32
index 5610917..a269606 100644
 
33
--- a/src/cff/cf2intrp.c
 
34
+++ b/src/cff/cf2intrp.c
 
35
@@ -593,8 +593,11 @@
 
36
 
 
37
         /* never add hints after the mask is computed */
 
38
         if ( cf2_hintmask_isValid( &hintMask ) )
 
39
+        {
 
40
           FT_TRACE4(( "cf2_interpT2CharString:"
 
41
                       " invalid horizontal hint mask\n" ));
 
42
+          break;
 
43
+        }
 
44
 
 
45
         cf2_doStems( font,
 
46
                      opStack,
 
47
@@ -614,8 +617,11 @@
 
48
 
 
49
         /* never add hints after the mask is computed */
 
50
         if ( cf2_hintmask_isValid( &hintMask ) )
 
51
+        {
 
52
           FT_TRACE4(( "cf2_interpT2CharString:"
 
53
                       " invalid vertical hint mask\n" ));
 
54
+          break;
 
55
+        }
 
56
 
 
57
         cf2_doStems( font,
 
58
                      opStack,
 
59
@@ -1141,15 +1147,16 @@
 
60
         /* `cf2_hintmask_read' (which also traces the mask bytes) */
 
61
         FT_TRACE4(( op1 == cf2_cmdCNTRMASK ? " cntrmask" : " hintmask" ));
 
62
 
 
63
-        /* if there are arguments on the stack, there this is an */
 
64
-        /* implied cf2_cmdVSTEMHM                                */
 
65
-        if ( cf2_stack_count( opStack ) != 0 )
 
66
+        /* never add hints after the mask is computed */
 
67
+        if ( cf2_stack_count( opStack ) > 1    &&
 
68
+             cf2_hintmask_isValid( &hintMask ) )
 
69
         {
 
70
-          /* never add hints after the mask is computed */
 
71
-          if ( cf2_hintmask_isValid( &hintMask ) )
 
72
-            FT_TRACE4(( "cf2_interpT2CharString: invalid hint mask\n" ));
 
73
+          FT_TRACE4(( "cf2_interpT2CharString: invalid hint mask\n" ));
 
74
+          break;
 
75
         }
 
76
 
 
77
+        /* if there are arguments on the stack, there this is an */
 
78
+        /* implied cf2_cmdVSTEMHM                                */
 
79
         cf2_doStems( font,
 
80
                      opStack,
 
81
                      &vStemHintArray,
 
82
--
 
83
cgit v0.9.0.2