rpms/freetype-freeworld/devel freetype-2.4.3-CVE-2010-3855.patch, NONE, 1.1 freetype-freeworld.spec, 1.11, 1.12
Author: kkofler
Update of /cvs/free/rpms/freetype-freeworld/devel
In directory se02.es.rpmfusion.net:/tmp/cvs-serv26975/devel
Modified Files:
freetype-freeworld.spec
Added Files:
freetype-2.4.3-CVE-2010-3855.patch
Log Message:
* Mon Nov 15 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.4.3-2
- Add freetype-2.4.3-CVE-2010-3855.patch
(Protect against invalid `runcnt' values.)
- Resolves: rh#651764
freetype-2.4.3-CVE-2010-3855.patch:
ttgxvar.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- NEW FILE freetype-2.4.3-CVE-2010-3855.patch ---
--- freetype-2.4.3/src/truetype/ttgxvar.c 2010-07-12 21:03:49.000000000 +0200
+++ freetype-2.4.3/src/truetype/ttgxvar.c 2010-11-15 10:23:43.856348141 +0100
@@ -154,7 +154,7 @@
runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK;
first = points[i++] = FT_GET_USHORT();
- if ( runcnt < 1 )
+ if ( runcnt < 1 || i + runcnt >= n )
goto Exit;
/* first point not included in runcount */
@@ -165,7 +165,7 @@
{
first = points[i++] = FT_GET_BYTE();
- if ( runcnt < 1 )
+ if ( runcnt < 1 || i + runcnt >= n )
goto Exit;
for ( j = 0; j < runcnt; ++j )
Index: freetype-freeworld.spec
===================================================================
RCS file: /cvs/free/rpms/freetype-freeworld/devel/freetype-freeworld.spec,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- freetype-freeworld.spec 26 Oct 2010 14:17:32 -0000 1.11
+++ freetype-freeworld.spec 15 Nov 2010 12:45:07 -0000 1.12
@@ -6,7 +6,7 @@
Summary: A free and portable font rendering engine
Name: freetype-freeworld
Version: 2.4.3
-Release: 1%{?dist}
+Release: 2%{?dist}
License: FTL or GPLv2+
Group: System Environment/Libraries
URL: http://www.freetype.org
@@ -18,8 +18,9 @@
# Enable otvalid and gxvalid modules
Patch46: freetype-2.2.1-enable-valid.patch
-# Security patch
+# Security patches
Patch89: freetype-2.4.2-CVE-2010-3311.patch
+Patch90: freetype-2.4.3-CVE-2010-3855.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-root-%(%{__id_u} -n)
@@ -61,6 +62,7 @@
%patch46 -p1 -b .enable-valid
%patch89 -p1 -b .CVE-2010-3311
+%patch90 -p1 -b .CVE-2010-3855
%build
@@ -105,6 +107,11 @@
%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
%changelog
+* Mon Nov 15 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.4.3-2
+- Add freetype-2.4.3-CVE-2010-3855.patch
+ (Protect against invalid `runcnt' values.)
+- Resolves: rh#651764
+
* Tue Oct 26 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.4.3-1
- Update to 2.4.3 (matches Fedora freetype)