bugThe FreeType Project - Bugs: bug #44495, Fix for bug #43547 (PCF parser...

 
 

bug #44495: Fix for bug #43547 (PCF parser overflow) breaks fixed font

Submitted by:  Chris Bainbridge <bain>
Submitted on:  Mon 09 Mar 2015 06:02:09 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.5

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 09 Mar 2015 07:07:36 PM UTC, comment #1:

In case you experience a bug please always try the last released version – or even better, please try the current git. The problem you are describing in this bug report has already been fixed in version 2.5.5: It displays the fixedsc fonts just fine.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 09 Mar 2015 06:02:09 PM UTC, original submission:

Using font FixedSC from http://pts-mini-gpl.googlecode.com/svn/trunk/fonts/fixedsc.tgz

run gnome terminal or terminator
terminal text is corrupt: http://imgur.com/DQZtDBb
downgrade back to libfreetype6_2.5.2-2: terminal text is now ok

The bad patch seems to be: 0020-Fix-Savannah-bug-43547.-CVE-2014-9671.patch:

+ /* we now check whether the `size' and `offset' values are reasonable: */
+ /* `offset' + `size' must not exceed the stream size */
+ tables = face->toc.tables;
+ for ( n = 0; n < toc->count; n++ )
+ {
+ /* we need two checks to avoid overflow */
+ if ( ( tables->size > stream->size ) ||
+ ( tables->offset > stream->size - tables->size ) )
+ {
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+ tables++;
+ }
+

This fails when:

tables->size=100
tables->offset=339968
stream->size=340040
tables->offset > stream->size - tables->size
339968 > 340040-100(=339940)

.xsession-errors:

/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to create cairo scaled font, expect ugly output. the offending font is 'FixedSC 11'
self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: font_face status is: out of memory
self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: scaled_font status is: out of memory
self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC 11', text=' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to create cairo scaled font, expect ugly output. the offending font is 'FixedSC Bold 11'
self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC Bold 11', text=' !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
self.present()

Chris Bainbridge <bain>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bain (Submitted the item)
  • -unavailable- added by bain
  • -unavailable- added by bain
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 09 Mar 2015 07:07:36 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.5
    Mon 09 Mar 2015 06:02:09 PM UTCbainCarbon-Copy-=>Added wl
      Carbon-Copy-=>Added j00ru

    Back to the top


    Powered by Savane 3.1-cleanup1