The FreeType Project - Bugs: bug #43538, FreeType 2.5.3 Mac font parsing...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43538: FreeType 2.5.3 Mac font parsing heap-based buffer overflow due to multiple integer overflows
Submitter: | Mateusz Jurczyk <j00ru> | ||
Submitted: | Wed 05 Nov 2014 01:46:51 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Crash |
Status: | Fixed | Privacy: | Public |
Assigned to: | mpsuzuki | Open/Closed: | Closed |
Planned Release: | 2.5.4 |
Jump to the original submission
Wed 26 Nov 2014 08:50:49 PM UTC, comment #16: |
Mateusz Jurczyk <j00ru> |
Wed 26 Nov 2014 03:46:43 PM UTC, comment #15: Thank you for reviewing and finding my slipping point.
|
suzuki toshiya <mpsuzuki> |
Wed 26 Nov 2014 11:31:28 AM UTC, comment #14: Thanks for the patch! :)
|
Mateusz Jurczyk <j00ru> |
Wed 26 Nov 2014 09:11:49 AM UTC, comment #13: Sorry, no need to close the discussion, |
suzuki toshiya <mpsuzuki> |
Wed 26 Nov 2014 09:10:08 AM UTC, comment #12: Committed to GIT. |
suzuki toshiya <mpsuzuki> |
Fri 21 Nov 2014 04:07:54 PM UTC, comment #11: Sorry, this week I could not have returned to my lab.
|
suzuki toshiya <mpsuzuki> |
Fri 21 Nov 2014 03:31:34 PM UTC, comment #10: Ping? :-) |
Mateusz Jurczyk <j00ru> |
Wed 12 Nov 2014 12:41:52 PM UTC, comment #9: Sorry for the late response.
|
Werner LEMBERG <wl> |
Wed 12 Nov 2014 12:16:15 PM UTC, comment #8: Thanks for uploading the patch! Just to make sure: is it the only patch to fix bugs #43538 (this one) and #43539, or is it going to be applied on top of Comment #2 in this bug (https://savannah.nongnu.org/bugs/?43538#comment2)? |
Mateusz Jurczyk <j00ru> |
Wed 12 Nov 2014 11:24:15 AM UTC, comment #7: Oh, sorry. The error you received is similar to one that
|
suzuki toshiya <mpsuzuki> |
Wed 12 Nov 2014 10:26:58 AM UTC, comment #6: Hi,
|
Mateusz Jurczyk <j00ru> |
Tue 11 Nov 2014 04:26:21 AM UTC, comment #5: Here is a patch using FT_ULong types to handle
|
suzuki toshiya <mpsuzuki> |
Tue 11 Nov 2014 01:19:33 AM UTC, comment #4: Thank you for comment, oops, I uploaded a concatenated
|
suzuki toshiya <mpsuzuki> |
Mon 10 Nov 2014 05:18:44 PM UTC, comment #3: Hi Suzuki Toshiya,
|
Mateusz Jurczyk <j00ru> |
Mon 10 Nov 2014 02:41:59 AM UTC, comment #2: Dear Mateusz,
|
suzuki toshiya <mpsuzuki> |
Wed 05 Nov 2014 02:04:35 PM UTC, comment #1: Toshiya-san, please have a look. |
Werner LEMBERG <wl> |
Wed 05 Nov 2014 01:46:51 PM UTC, original submission:
In the freetype/src/base/ftobjs.c file, we can find multiple auxiliary functions for handling uncommon or exotic font formats. One such function is "Mac_Read_POST_Resource", which heavily operates on user-supplied data:
|
Mateusz Jurczyk <j00ru> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 13 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-08-22 | wl | Privacy | Private | Public | |
2014-12-01 | mpsuzuki | Open/Closed | Open | Closed | |
2014-11-26 | mpsuzuki | Open/Closed | Closed | Open | |
2014-11-26 | mpsuzuki | Open/Closed | Open | Closed | |
Planned Release | None | 2.5.4 | |||
2014-11-26 | mpsuzuki | Open/Closed | Closed | Open | |
2014-11-26 | mpsuzuki | Status | Ready For Test | Fixed | |
Open/Closed | Open | Closed | |||
2014-11-11 | mpsuzuki | Attached File | - | Added mps20141111e.diff, #32411 | |
2014-11-10 | mpsuzuki | Attached File | - | Added mps20141110b.diff, #32396 | |
Status | None | Ready For Test | |||
2014-11-05 | wl | Assigned to | None | mpsuzuki | |
2014-11-05 | j00ru | Attached File | - | Added 1.ttf, #32373 |
Powered by Savane 3.13-bb6a.
Corresponding source code
Looks good, thanks!