The FreeType Project - Bugs: bug #31310, ft_var_readpackedpoints() buffer...

You are not allowed to post comments on this tracker with your current authentication level.

bug #31310: ft_var_readpackedpoints() buffer overflow

Submitter:	None
Submitted:	Mon 11 Oct 2010 11:03:45 PM UTC
Severity:	3 - Normal	Item Group:	Crash
Status:	Fixed	Privacy:	Public
Assigned to:	wl	Open/Closed:	Closed
Planned Release:	2.4.4

Tue 12 Oct 2010 05:55:19 AM UTC, comment #1:  This should be fixed in the git.  Thanks for the report.  Please test. Unfortunately, I don't have a GX font for testing which calls `ft_var_readpackedpoints' at all.  If you have such a font I would be glad if you could provide it to me privately.	Werner LEMBERG <wl>
Mon 11 Oct 2010 11:03:45 PM UTC, original submission:   The function ft_var_readpackedpoints() in src/truetype/ttgxvar.c has a buffer overflow, leading to crashes and potential code execution. When parsing a malicious TrueType GX font with n set to a lower value than runcnt, the for loops in the function will keep writing outside of allocated memory. This was tested on version 2.4.3. -- "van damme's brain cell"	Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List

-email is unavailable- added by wl (Posted a comment)

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Copyright © 2024 Free Software Foundation, Inc.
Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
Page source code