summarylogtreecommitdiffstats
path: root/freetype-2.4.11-CVE-2014-9669.patch
diff options
context:
space:
mode:
Diffstat (limited to 'freetype-2.4.11-CVE-2014-9669.patch')
-rw-r--r--freetype-2.4.11-CVE-2014-9669.patch117
1 files changed, 117 insertions, 0 deletions
diff --git a/freetype-2.4.11-CVE-2014-9669.patch b/freetype-2.4.11-CVE-2014-9669.patch
new file mode 100644
index 00000000000..59fe8c3b67c
--- /dev/null
+++ b/freetype-2.4.11-CVE-2014-9669.patch
@@ -0,0 +1,117 @@
+From 602040b1112c9f94d68e200be59ea7ac3d104565 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Wed, 12 Nov 2014 19:51:20 +0000
+Subject: [sfnt] Fix Savannah bug #43588.
+
+* src/sfnt/ttcmap.c (tt_cmap8_validate, tt_cmap10_validate,
+tt_cmap12_validate, tt_cmap13_validate, tt_cmap14_validate): Protect
+against overflow in additions and multiplications.
+---
+diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
+index f9acf5d..712bd4f 100644
+--- a/src/sfnt/ttcmap.c
++++ b/src/sfnt/ttcmap.c
+@@ -1647,7 +1647,8 @@
+ p = is32 + 8192; /* skip `is32' array */
+ num_groups = TT_NEXT_ULONG( p );
+
+- if ( p + num_groups * 12 > valid->limit )
++ /* p + num_groups * 12 > valid->limit ? */
++ if ( num_groups > (FT_UInt32)( valid->limit - p ) / 12 )
+ FT_INVALID_TOO_SHORT;
+
+ /* check groups, they must be in increasing order */
+@@ -1672,7 +1673,12 @@
+
+ if ( valid->level >= FT_VALIDATE_TIGHT )
+ {
+- if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) )
++ FT_UInt32 d = end - start;
++
++
++ /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */
++ if ( d > TT_VALID_GLYPH_COUNT( valid ) ||
++ start_id >= TT_VALID_GLYPH_COUNT( valid ) - d )
+ FT_INVALID_GLYPH_ID;
+
+ count = (FT_UInt32)( end - start + 1 );
+@@ -1870,7 +1876,9 @@
+ count = TT_NEXT_ULONG( p );
+
+ if ( length > (FT_ULong)( valid->limit - table ) ||
+- length < 20 + count * 2 )
++ /* length < 20 + count * 2 ? */
++ length < 20 ||
++ ( length - 20 ) / 2 < count )
+ FT_INVALID_TOO_SHORT;
+
+ /* check glyph indices */
+@@ -2057,7 +2065,9 @@
+ num_groups = TT_NEXT_ULONG( p );
+
+ if ( length > (FT_ULong)( valid->limit - table ) ||
+- length < 16 + 12 * num_groups )
++ /* length < 16 + 12 * num_groups ? */
++ length < 16 ||
++ ( length - 16 ) / 12 < num_groups )
+ FT_INVALID_TOO_SHORT;
+
+ /* check groups, they must be in increasing order */
+@@ -2079,7 +2089,12 @@
+
+ if ( valid->level >= FT_VALIDATE_TIGHT )
+ {
+- if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) )
++ FT_UInt32 d = end - start;
++
++
++ /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */
++ if ( d > TT_VALID_GLYPH_COUNT( valid ) ||
++ start_id >= TT_VALID_GLYPH_COUNT( valid ) - d )
+ FT_INVALID_GLYPH_ID;
+ }
+
+@@ -2381,7 +2396,9 @@
+ num_groups = TT_NEXT_ULONG( p );
+
+ if ( length > (FT_ULong)( valid->limit - table ) ||
+- length < 16 + 12 * num_groups )
++ /* length < 16 + 12 * num_groups ? */
++ length < 16 ||
++ ( length - 16 ) / 12 < num_groups )
+ FT_INVALID_TOO_SHORT;
+
+ /* check groups, they must be in increasing order */
+@@ -2762,7 +2779,9 @@
+
+
+ if ( length > (FT_ULong)( valid->limit - table ) ||
+- length < 10 + 11 * num_selectors )
++ /* length < 10 + 11 * num_selectors ? */
++ length < 10 ||
++ ( length - 10 ) / 11 < num_selectors )
+ FT_INVALID_TOO_SHORT;
+
+ /* check selectors, they must be in increasing order */
+@@ -2798,7 +2817,8 @@
+ FT_ULong lastBase = 0;
+
+
+- if ( defp + numRanges * 4 > valid->limit )
++ /* defp + numRanges * 4 > valid->limit ? */
++ if ( numRanges > (FT_ULong)( valid->limit - defp ) / 4 )
+ FT_INVALID_TOO_SHORT;
+
+ for ( i = 0; i < numRanges; ++i )
+@@ -2825,7 +2845,8 @@
+ FT_ULong i, lastUni = 0;
+
+
+- if ( numMappings * 4 > (FT_ULong)( valid->limit - ndp ) )
++ /* numMappings * 4 > (FT_ULong)( valid->limit - ndp ) ? */
++ if ( numMappings > ( (FT_ULong)( valid->limit - ndp ) ) / 4 )
+ FT_INVALID_TOO_SHORT;
+
+ for ( i = 0; i < numMappings; ++i )
+--
+cgit v0.9.0.2