The FreeType Project - Bugs: bug #43597, FreeType 2.5.3 sbix PNG handling...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43597: FreeType 2.5.3 sbix PNG handling heap-based buffer overflow due to integer overflow
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Thu 13 Nov 2014 09:56:56 AM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Jump to the original submission
Tue 02 Dec 2014 01:56:31 PM UTC, comment #9: |
Alexei Podtelezhnikov <podtelez> |
Tue 02 Dec 2014 09:38:50 AM UTC, comment #8: Uh, oh, I consider `-Werror' as evil if used for production, since it is too much dependent on the compiler – and it has zero value for the end user.
|
Werner LEMBERG <wl> |
Sat 29 Nov 2014 09:55:17 PM UTC, comment #7: Unfortunately b3500af717010137046ec4076d1e1c0641e33727 is source incompatible for anything using -Werror.
|
Sergio Martins <iamsergio> |
Fri 21 Nov 2014 04:04:39 PM UTC, comment #6: Yes, this is the corresponding code. Thanks for checking. |
Werner LEMBERG <wl> |
Fri 21 Nov 2014 03:00:13 PM UTC, comment #5: I assume this is now fixed by http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=b3500af717010137046ec4076d1e1c0641e33727?
|
Mateusz Jurczyk <j00ru> |
Mon 17 Nov 2014 05:51:17 PM UTC, comment #4: With signed 32-bit width/height, things really get complicated, because it's a mismatch between the unsigned type used in the IHDR PNG structure.
|
Mateusz Jurczyk <j00ru> |
Mon 17 Nov 2014 05:31:32 PM UTC, comment #3: Of course, the 32767-by-32767 bitmap limit, or 1 gigapixel, is plenty and should by sufficient for years to come. For the record though, we could use some alternatives:
|
Alexei Podtelezhnikov <podtelez> |
Mon 17 Nov 2014 05:13:57 PM UTC, comment #2: Dear Werner,
|
Mateusz Jurczyk <j00ru> |
Sat 15 Nov 2014 08:06:40 AM UTC, comment #1: Thanks for the report. Fixed in git, please test. |
Werner LEMBERG <wl> |
Thu 13 Nov 2014 09:56:56 AM UTC, original submission:
FreeType 2.5.3 supports embedded bitmaps in SFNT-based fonts, in one of the three standard graphics formats (PNG), while JPEG and TIFF are not yet supported. Such bitmaps can be found in the Apple-defined "sbix" tables (see https://developer.apple.com/fonts/TrueType-Reference-Manual/RM06/Chap6sbix.html), which in the PNG case is internally handled in FreeType by the "Load_SBit_Png" function implemented in freetype/src/sfnt/pngshim.c.
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-11-15 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 | |||
2014-11-13 | j00ru | Attached File | - | Added poc.ttf, #32427 | |
Carbon-Copy | - | Added -email is unavailable- |
Powered by Savane 3.13-3230.
Corresponding source code
This is not an issue. C permits signed-unsigned comparison, period.