bugThe FreeType Project - Bugs: bug #12107, Incorrect handling of embedded...

 
 

bug #12107: Incorrect handling of embedded bitmaps

Submitted by:  David Turner <freetype>
Submitted on:  Wed 23 Feb 2005 09:02:31 AM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: David Turner <freetype>Open/Closed: Closed
Planned Release: 2.1.10

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 23 Feb 2005 09:02:31 AM UTC, original submission:

The FreeType embedded bitmap loader doesnt deal correctly with missing glyphs, which are encoded with the following scheme in the EBLC table:

"A small number of missing glyphs can be efficiently represented in formats 1 or 3 by having the offset for the missing glyph be followed by the same offset for the next glyph, thus indicating a data size of zero."

FreeType never checks the size of the bitmap, it will simply merely try to decode wathever is at the address pointed to by the first offset. What this means is that:

- missing glyphs will be read, instead of ignored. Their content correspond to the next valid glyph in the range, or anything that happens to be at the glyph offset in the EBDT table.

- in exceptional circumstances, this could lead to an over-read of the EBDT table, which can lead to a crash in the case of memory-mapped files with page-level protection.

David Turner <freetype>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 28 Feb 2005 10:10:43 PM UTCfreetypeStatusNone=>Fixed
  Open/ClosedOpen=>Closed
  Planned ReleaseNone=>2.1.10

Back to the top


Powered by Savane 3.1-cleanup1