bugThe FreeType Project - Bugs: bug #44495, Fix for bug #43547 (PCF parser...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #44495: Fix for bug #43547 (PCF parser overflow) breaks fixed font

Submitter:  Chris Bainbridge <bain>
Submitted:  Mon 09 Mar 2015 06:02:09 PM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.5.5

Mon 09 Mar 2015 07:07:36 PM UTC, comment #1: 

In case you experience a bug please always try the last released version – or even better, please try the current git.  The problem you are describing in this bug report has already been fixed in version 2.5.5: It displays the fixedsc fonts just fine.

Werner LEMBERG <wl>
Group administrator
Mon 09 Mar 2015 06:02:09 PM UTC, original submission:  

Using font FixedSC from http://pts-mini-gpl.googlecode.com/svn/trunk/fonts/fixedsc.tgz

run gnome terminal or terminator
terminal text is corrupt: http://imgur.com/DQZtDBb
downgrade back to libfreetype6_2.5.2-2: terminal text is now ok


The bad patch seems to be: 0020-Fix-Savannah-bug-43547.-CVE-2014-9671.patch:

+    /* we now check whether the `size' and `offset' values are reasonable: */
+    /* `offset' + `size' must not exceed the stream size                   */
+    tables = face->toc.tables;
+    for ( n = 0; n < toc->count; n++ )
+    {
+      /* we need two checks to avoid overflow */
+      if ( ( tables->size   > stream->size                ) ||
+           ( tables->offset > stream->size - tables->size ) )
+      {
+        error = FT_THROW( Invalid_Table );
+        goto Exit;
+      }
+      tables++;
+    }
+


This fails when:

tables->size=100
tables->offset=339968
stream->size=340040
tables->offset > stream->size - tables->size
339968 > 340040-100(=339940)


.xsession-errors:

/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to create cairo scaled font, expect ugly output. the offending font is 'FixedSC 11'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: font_face status is: out of memory
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: scaled_font status is: out of memory
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC 11', text=' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to create cairo scaled font, expect ugly output. the offending font is 'FixedSC Bold 11'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC Bold 11', text=' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
  self.present()

Chris Bainbridge <bain>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by bain (Submitted the item)
  • -email is unavailable- added by bain
  • -email is unavailable- added by bain
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-09 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.5.5
    2015-03-09 bain Carbon-Copy- Added wl
        Carbon-Copy- Added j00ru

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code