rpms/freetype-freeworld/F-14 freetype-2.4.2-CVE-2010-3855.patch, NONE, 1.1 freetype-freeworld.spec, 1.10, 1.11

[Kevin Kofler]

Author: kkofler

Update of /cvs/free/rpms/freetype-freeworld/F-14
In directory se02.es.rpmfusion.net:/tmp/cvs-serv27014/F-14

Modified Files:
	freetype-freeworld.spec 
Added Files:
	freetype-2.4.2-CVE-2010-3855.patch 
Log Message:
* Mon Nov 15 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.2-3
- Add freetype-2.4.2-CVE-2010-3855.patch
    (Protect against invalid `runcnt' values.)
- Resolves: rh#651764

freetype-2.4.2-CVE-2010-3855.patch:
 ttgxvar.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- NEW FILE freetype-2.4.2-CVE-2010-3855.patch ---
--- freetype-2.4.2/src/truetype/ttgxvar.c	2010-07-12 21:03:49.000000000 +0200
+++ freetype-2.4.2/src/truetype/ttgxvar.c	2010-11-15 10:23:12.725915774 +0100
@@ -154,7 +154,7 @@
         runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK;
         first  = points[i++] = FT_GET_USHORT();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         /* first point not included in runcount */
@@ -165,7 +165,7 @@
       {
         first = points[i++] = FT_GET_BYTE();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         for ( j = 0; j < runcnt; ++j )


Index: freetype-freeworld.spec
===================================================================
RCS file: /cvs/free/rpms/freetype-freeworld/F-14/freetype-freeworld.spec,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- freetype-freeworld.spec	6 Oct 2010 18:21:48 -0000	1.10
+++ freetype-freeworld.spec	15 Nov 2010 12:45:34 -0000	1.11
@@ -6,7 +6,7 @@
 Summary: A free and portable font rendering engine
 Name: freetype-freeworld
 Version: 2.4.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: FTL or GPLv2+
 Group: System Environment/Libraries
 URL: http://www.freetype.org
@@ -18,8 +18,9 @@
 # Enable otvalid and gxvalid modules
 Patch46:  freetype-2.2.1-enable-valid.patch
 
-# Security patch
+# Security patches
 Patch89:  freetype-2.4.2-CVE-2010-3311.patch
+Patch90:  freetype-2.4.2-CVE-2010-3855.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-root-%(%{__id_u} -n)
 
@@ -61,6 +62,7 @@
 %patch46  -p1 -b .enable-valid
 
 %patch89 -p1 -b .CVE-2010-3311
+%patch90 -p1 -b .CVE-2010-3855
 
 %build
 
@@ -105,6 +107,11 @@
 %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 %changelog
+* Mon Nov 15 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.2-3
+- Add freetype-2.4.2-CVE-2010-3855.patch
+    (Protect against invalid `runcnt' values.)
+- Resolves: rh#651764
+
 * Wed Oct 06 2010 Kevin Kofler <Kevin at tigcc.ticalc.org> 2.4.2-2
 - Add freetype-2.4.2-CVE-2010-3311.patch
     (Don't seek behind end of stream.)