Author: kkofler Update of /cvs/free/rpms/freetype-freeworld/devel In directory se02.es.rpmfusion.net:/tmp/cvs-serv26975/devel Modified Files: freetype-freeworld.spec Added Files: freetype-2.4.3-CVE-2010-3855.patch Log Message: * Mon Nov 15 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.4.3-2 - Add freetype-2.4.3-CVE-2010-3855.patch (Protect against invalid `runcnt' values.) - Resolves: rh#651764 freetype-2.4.3-CVE-2010-3855.patch: ttgxvar.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- NEW FILE freetype-2.4.3-CVE-2010-3855.patch --- --- freetype-2.4.3/src/truetype/ttgxvar.c 2010-07-12 21:03:49.000000000 +0200 +++ freetype-2.4.3/src/truetype/ttgxvar.c 2010-11-15 10:23:43.856348141 +0100 @@ -154,7 +154,7 @@ runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; first = points[i++] = FT_GET_USHORT(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; /* first point not included in runcount */ @@ -165,7 +165,7 @@ { first = points[i++] = FT_GET_BYTE(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; for ( j = 0; j < runcnt; ++j ) Index: freetype-freeworld.spec =================================================================== RCS file: /cvs/free/rpms/freetype-freeworld/devel/freetype-freeworld.spec,v retrieving revision 1.11 retrieving revision 1.12 diff -u -r1.11 -r1.12 --- freetype-freeworld.spec 26 Oct 2010 14:17:32 -0000 1.11 +++ freetype-freeworld.spec 15 Nov 2010 12:45:07 -0000 1.12 @@ -6,7 +6,7 @@ Summary: A free and portable font rendering engine Name: freetype-freeworld Version: 2.4.3 -Release: 1%{?dist} +Release: 2%{?dist} License: FTL or GPLv2+ Group: System Environment/Libraries URL: http://www.freetype.org @@ -18,8 +18,9 @@ # Enable otvalid and gxvalid modules Patch46: freetype-2.2.1-enable-valid.patch -# Security patch +# Security patches Patch89: freetype-2.4.2-CVE-2010-3311.patch +Patch90: freetype-2.4.3-CVE-2010-3855.patch BuildRoot: %{_tmppath}/%{name}-%{version}-root-%(%{__id_u} -n) @@ -61,6 +62,7 @@ %patch46 -p1 -b .enable-valid %patch89 -p1 -b .CVE-2010-3311 +%patch90 -p1 -b .CVE-2010-3855 %build @@ -105,6 +107,11 @@ %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %changelog +* Mon Nov 15 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.4.3-2 +- Add freetype-2.4.3-CVE-2010-3855.patch + (Protect against invalid `runcnt' values.) +- Resolves: rh#651764 + * Tue Oct 26 2010 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.4.3-1 - Update to 2.4.3 (matches Fedora freetype)