diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2007-05-25 01:23:30 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2007-05-25 01:23:30 +0000 |
| commit | 4365e278c0984c45d3034ee70dbec61b317cd9f5 (patch) | |
| tree | a0657761ddf953a3d45c682f5f1438856845f087 | |
| parent | a18ec228bf47f080aa4e5cb277521ace3534e18a (diff) | |
Fix for CVE-2007-2754: integer overflow that can lead to an heap overflow.
Discovered by Victor Stinner. Patch from Freetype repository.
| -rw-r--r-- | lib/freetype/src/truetype/ttgload.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/freetype/src/truetype/ttgload.c b/lib/freetype/src/truetype/ttgload.c index 158111384..deb6b978b 100644 --- a/lib/freetype/src/truetype/ttgload.c +++ b/lib/freetype/src/truetype/ttgload.c @@ -269,7 +269,11 @@ n_points = 0; if ( n_contours > 0 ) + { n_points = cont[-1] + 1; + if ( n_points < 0 ) + goto Invalid_Outline; + } /* note that we will add four phantom points later */ error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 ); @@ -677,7 +681,7 @@ FT_GlyphLoader gloader = loader->gloader; FT_Error error = TT_Err_Ok; FT_Outline* outline; - FT_UInt n_points; + FT_Int n_points; outline = &gloader->current.outline; @@ -704,7 +708,7 @@ /* Deltas apply to the unscaled data. */ FT_Vector* deltas; FT_Memory memory = loader->face->memory; - FT_UInt i; + FT_Int i; error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face), |