The FreeType Project - Bugs: bug #43588, FreeType 2.5.3 SFNT parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43588: FreeType 2.5.3 SFNT parsing multiple out-of-bounds reads due to integer overflows in "cmap" table handling
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Wed 12 Nov 2014 02:07:40 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Thu 13 Nov 2014 08:10:36 AM UTC, comment #2: |
Mateusz Jurczyk <j00ru> |
Wed 12 Nov 2014 07:52:16 PM UTC, comment #1: Thanks for the report. Fixed in git, please check. |
Werner LEMBERG <wl> |
Wed 12 Nov 2014 02:07:40 PM UTC, original submission:
In the freetype/src/sfnt/ttcmap.c file, we can find functions responsible for handling the "cmap" SFNT table (http://www.microsoft.com/typography/otspec/cmap.htm) in different formats (0, 2, 4, 6, 8, 10, 12, 13, 14). Multiple integer overflow conditions exist in the code if it is compiled for 32-bit architectures (i.e. when sizeof(long) = 4), see:
|
Mateusz Jurczyk <j00ru> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-11-12 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 |
Powered by Savane 3.13-3230.
Corresponding source code
The fix LGTM, thanks!