The FreeType Project - Bugs: bug #43539, FreeType 2.5.3 Mac font parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43539: FreeType 2.5.3 Mac font parsing heap-based buffer overflow due to integer signedness problems
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Wed 05 Nov 2014 02:06:01 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | mpsuzuki | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Wed 26 Nov 2014 09:11:03 AM UTC, comment #5: |
suzuki toshiya <mpsuzuki> |
Tue 11 Nov 2014 04:21:29 AM UTC, comment #4: For further discussions, I decided to work this issue
|
suzuki toshiya <mpsuzuki> |
Tue 11 Nov 2014 12:51:10 AM UTC, comment #3: Here is a concatenated patch to fix #43538 + #43539.
|
suzuki toshiya <mpsuzuki> |
Mon 10 Nov 2014 09:53:29 AM UTC, comment #2: Dear Mateusz,
|
suzuki toshiya <mpsuzuki> |
Wed 05 Nov 2014 05:12:14 PM UTC, comment #1: Toshiya-san, please check this also. |
Werner LEMBERG <wl> |
Wed 05 Nov 2014 02:06:01 PM UTC, original submission:
In the freetype/src/base/ftobjs.c file, we can find multiple auxiliary functions for handling uncommon or exotic font formats. One such function is "Mac_Read_POST_Resource", which heavily operates on user-supplied data:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-08-22 | wl | Privacy | Private | Public | |
2014-11-26 | mpsuzuki | Open/Closed | Open | Closed | |
Planned Release | None | 2.5.4 | |||
2014-11-26 | mpsuzuki | Status | Ready For Test | Fixed | |
2014-11-11 | mpsuzuki | Attached File | - | Added mps20141111d.diff, #32407 | |
Status | Confirmed | Ready For Test | |||
2014-11-10 | mpsuzuki | Status | None | Confirmed | |
2014-11-05 | wl | Assigned to | None | mpsuzuki | |
2014-11-05 | j00ru | Attached File | - | Added 2.ttf, #32374 |
Powered by Savane 3.13-4448.
Corresponding source code
Committed to GIT, in bug #43538 issue.