The FreeType Project - Bugs: bug #43535, FreeType 2.5.3 BDF parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43535: FreeType 2.5.3 BDF parsing potential heap pointer disclosure
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Wed 05 Nov 2014 12:14:17 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Incorrect behaviour |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Fri 07 Nov 2014 09:17:48 AM UTC, comment #2: |
Mateusz Jurczyk <j00ru> |
Fri 07 Nov 2014 08:40:25 AM UTC, comment #1: Fixed in git, thanks. I'm curious: How did you find this issue? |
Werner LEMBERG <wl> |
Wed 05 Nov 2014 12:14:17 PM UTC, original submission:
In the internal "_bdf_add_property" function defined in freetype/src/bdf/bdflib.c, the following code can be found:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-11-07 | wl | Status | None | Fixed | |
Privacy | Private | Public | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.5.4 | |||
2014-11-05 | j00ru | Attached File | - | Added poc.bdf, #32372 |
Powered by Savane 3.13-3230.
Corresponding source code
I discovered the problem during a manual audit of the code, similarly to all other issues reported so far. :-)