[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <17746.1213141161@devserv.devel.redhat.com>
Date: Tue, 10 Jun 2008 19:39:21 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: FreeType 2.3.6
On 10 June 2008, Josh Bressers wrote:
> So it seems FreeType 2.3.6 fixes some security issues:
>
> - A bunch of potential security problems have been found. All
> users should update.
>
> Does anyone have a freetype contact who we can try to convince to work with
> the community in the future (or give us patches for these)?
>
After looking at the iDefense advisory, and through the Freetype changelog,
it looks like this is the changeset we need to fix this:
2008-06-08 Werner Lemberg
* src/type1/t1parse.h (T1_ParserRec): Make `base_len' and
`private_len' unsigned.
* src/type1/t1parse.c (read_pfb_tag): Make `asize' unsigned and
* read
it as such.
(T1_New_Parser, T1_Get_Private_Dict): Make `size' unsigned.
* src/base/ftstream.c (FT_Stream_Skip): Reject negative values.
* src/type1/t1load.c (parse_blend_design_positions): Check `n_axis'
for sane value.
Fix typo.
* src/psaux/psobjs.c (ps_table_add): Check `idx' correctly.
* src/truetype/ttinterp (Ins_SHC): Use BOUNDS() to check
`last_point'.
* src/sfnt/ttload.c (tt_face_load_max_profile): Limit
`maxTwilightPoints'.
I'll attach the patch (with comment changes stripped).
--
JB
View attachment "freetype.patch" of type "text/plain" (5812 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
