summarylogtreecommitdiffstats
path: root/freetype-2.4.11-CVE-2014-9670.patch
diff options
context:
space:
mode:
Diffstat (limited to 'freetype-2.4.11-CVE-2014-9670.patch')
-rw-r--r--freetype-2.4.11-CVE-2014-9670.patch30
1 files changed, 30 insertions, 0 deletions
diff --git a/freetype-2.4.11-CVE-2014-9670.patch b/freetype-2.4.11-CVE-2014-9670.patch
new file mode 100644
index 00000000000..0a9b70a03e2
--- /dev/null
+++ b/freetype-2.4.11-CVE-2014-9670.patch
@@ -0,0 +1,30 @@
+From ef1eba75187adfac750f326b563fe543dd5ff4e6 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Thu, 06 Nov 2014 22:25:05 +0000
+Subject: Fix Savannah bug #43548.
+
+* src/pcf/pcfread (pcf_get_encodings): Add sanity checks for row and
+column values.
+---
+diff --git a/src/pcf/pcfread.c b/src/pcf/pcfread.c
+index 8db31bd..668c962 100644
+--- a/src/pcf/pcfread.c
++++ b/src/pcf/pcfread.c
+@@ -812,6 +812,15 @@ THE SOFTWARE.
+ if ( !PCF_FORMAT_MATCH( format, PCF_DEFAULT_FORMAT ) )
+ return PCF_Err_Invalid_File_Format;
+
++ /* sanity checks */
++ if ( firstCol < 0 ||
++ firstCol > lastCol ||
++ lastCol > 0xFF ||
++ firstRow < 0 ||
++ firstRow > lastRow ||
++ lastRow > 0xFF )
++ return PCF_Err_Invalid_Table;
++
+ FT_TRACE4(( "pdf_get_encodings:\n" ));
+
+ FT_TRACE4(( " firstCol %d, lastCol %d, firstRow %d, lastRow %d\n",
+--
+cgit v0.9.0.2