The FreeType Project - Bugs: bug #31310, ft_var_readpackedpoints() buffer...
You are not allowed to post comments on this tracker with your current authentication level.
bug #31310: ft_var_readpackedpoints() buffer overflow
Submitter: | None | ||
Submitted: | Mon 11 Oct 2010 11:03:45 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.4.4 |
Tue 12 Oct 2010 05:55:19 AM UTC, comment #1: |
Werner LEMBERG <wl>![]() ![]() |
Mon 11 Oct 2010 11:03:45 PM UTC, original submission:
The function ft_var_readpackedpoints() in src/truetype/ttgxvar.c has a buffer overflow, leading to crashes and potential code execution.
|
Anonymous |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 4 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2010-10-12 | wl | Status | None | ![]() |
Fixed |
Assigned to | None | ![]() |
wl | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
2.4.4 |
This should be fixed in the git. Thanks for the report. Please test.
Unfortunately, I don't have a GX font for testing which calls `ft_var_readpackedpoints' at all. If you have such a font I would be glad if you could provide it to me privately.