rpms/freetype-freeworld/devel freetype-2.4.3-CVE-2010-3855.patch, NONE, 1.1 freetype-freeworld.spec, 1.11, 1.12

[Kevin Kofler]

Author: kkofler

Update of /cvs/free/rpms/freetype-freeworld/devel
In directory se02.es.rpmfusion.net:/tmp/cvs-serv26975/devel

Modified Files:
	freetype-freeworld.spec 
Added Files:
	freetype-2.4.3-CVE-2010-3855.patch 
Log Message:
* Mon Nov 15 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.3-2
- Add freetype-2.4.3-CVE-2010-3855.patch
    (Protect against invalid `runcnt' values.)
- Resolves: rh#651764

freetype-2.4.3-CVE-2010-3855.patch:
 ttgxvar.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- NEW FILE freetype-2.4.3-CVE-2010-3855.patch ---
--- freetype-2.4.3/src/truetype/ttgxvar.c	2010-07-12 21:03:49.000000000 +0200
+++ freetype-2.4.3/src/truetype/ttgxvar.c	2010-11-15 10:23:43.856348141 +0100
@@ -154,7 +154,7 @@
         runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK;
         first  = points[i++] = FT_GET_USHORT();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         /* first point not included in runcount */
@@ -165,7 +165,7 @@
       {
         first = points[i++] = FT_GET_BYTE();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         for ( j = 0; j < runcnt; ++j )


Index: freetype-freeworld.spec
===================================================================
RCS file: /cvs/free/rpms/freetype-freeworld/devel/freetype-freeworld.spec,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- freetype-freeworld.spec	26 Oct 2010 14:17:32 -0000	1.11
+++ freetype-freeworld.spec	15 Nov 2010 12:45:07 -0000	1.12
@@ -6,7 +6,7 @@
 Summary: A free and portable font rendering engine
 Name: freetype-freeworld
 Version: 2.4.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: FTL or GPLv2+
 Group: System Environment/Libraries
 URL: http://www.freetype.org
@@ -18,8 +18,9 @@
 # Enable otvalid and gxvalid modules
 Patch46:  freetype-2.2.1-enable-valid.patch
 
-# Security patch
+# Security patches
 Patch89:  freetype-2.4.2-CVE-2010-3311.patch
+Patch90:  freetype-2.4.3-CVE-2010-3855.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-root-%(%{__id_u} -n)
 
@@ -61,6 +62,7 @@
 %patch46  -p1 -b .enable-valid
 
 %patch89 -p1 -b .CVE-2010-3311
+%patch90 -p1 -b .CVE-2010-3855
 
 %build
 
@@ -105,6 +107,11 @@
 %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 %changelog
+* Mon Nov 15 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.3-2
+- Add freetype-2.4.3-CVE-2010-3855.patch
+    (Protect against invalid `runcnt' values.)
+- Resolves: rh#651764
+
 * Tue Oct 26 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.3-1
 - Update to 2.4.3 (matches Fedora freetype)