Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=dex77stuff.git;a=commitdiff;h=44784831d84efb7468df7bc4813528191aaf0d7c
commit 44784831d84efb7468df7bc4813528191aaf0d7c Author: kikadf <[email protected]> Date: Mon Mar 2 11:33:18 2015 +0100 freetype2-2.4.11-2-x86_64 * Fix CVE-2014-9656, CVE-2014-9657, CVE-2014-9658, CVE-2014-9660, * CVE-2014-9661, CVE-2014-9663, CVE-2014-9664, CVE-2014-9666, * CVE-2014-9667, CVE-2014-9669, CVE-2014-9670, CVE-2014-9671, * CVE-2014-9672, CVE-2014-9673, CVE-2014-9674, CVE-2014-9675 diff --git a/source/lib/freetype2/CVE-2014-9656-9675.patch b/source/lib/freetype2/CVE-2014-9656-9675.patch new file mode 100644 index 0000000..1206edd --- /dev/null +++ b/source/lib/freetype2/CVE-2014-9656-9675.patch @@ -0,0 +1,956 @@ +diff -Naur freetype-2.4.11/src/base/ftmac.c freetype-2.4.11.new/src/base/ftmac.c +--- freetype-2.4.11/src/base/ftmac.c 2012-01-17 11:32:16.000000000 +0100 ++++ freetype-2.4.11.new/src/base/ftmac.c 2015-02-27 10:15:06.682620600 +0100 +@@ -443,9 +443,10 @@ + style = (StyleTable*)p; + p += sizeof ( StyleTable ); + string_count = EndianS16_BtoN( *(short*)(p) ); ++ string_count = FT_MIN( 64, string_count ); + p += sizeof ( short ); + +- for ( i = 0; i < string_count && i < 64; i++ ) ++ for ( i = 0; i < string_count; i++ ) + { + names[i] = p; + p += names[i][0]; +@@ -462,7 +463,7 @@ + ps_name[ps_name_len] = 0; + } + if ( style->indexes[face_index] > 1 && +- style->indexes[face_index] <= FT_MIN( string_count, 64 ) ) ++ style->indexes[face_index] <= string_count ) + { + unsigned char* suffixes = names[style->indexes[face_index] - 1]; + +diff -Naur freetype-2.4.11/src/base/ftobjs.c freetype-2.4.11.new/src/base/ftobjs.c +--- freetype-2.4.11/src/base/ftobjs.c 2012-12-20 06:07:50.000000000 +0100 ++++ freetype-2.4.11.new/src/base/ftobjs.c 2015-02-27 10:15:06.883632100 +0100 +@@ -1545,9 +1545,9 @@ + FT_Memory memory = library->memory; + FT_Byte* pfb_data = NULL; + int i, type, flags; +- FT_Long len; +- FT_Long pfb_len, pfb_pos, pfb_lenpos; +- FT_Long rlen, temp; ++ FT_ULong len; ++ FT_ULong pfb_len, pfb_pos, pfb_lenpos; ++ FT_ULong rlen, temp; + + + if ( face_index == -1 ) +@@ -1563,11 +1563,34 @@ + error = FT_Stream_Seek( stream, offsets[i] ); + if ( error ) + goto Exit; +- if ( FT_READ_LONG( temp ) ) ++ if ( FT_READ_ULONG( temp ) ) + goto Exit; ++ ++ /* FT2 allocator takes signed long buffer length, ++ * too large value causing overflow should be checked ++ */ ++ FT_TRACE4(( " POST fragment #%d: length=0x%08x\n", ++ i, temp)); ++ if ( 0x7FFFFFFFUL < temp || pfb_len + temp + 6 < pfb_len ) ++ { ++ FT_TRACE2(( " too long fragment length makes" ++ " pfb_len confused: temp=0x%08x\n", temp )); ++ error = FT_Err_Invalid_Offset; ++ goto Exit; ++ } ++ + pfb_len += temp + 6; + } + ++ FT_TRACE2(( " total buffer size to concatenate %d" ++ " POST fragments: 0x%08x\n", ++ resource_cnt, pfb_len + 2)); ++ if ( pfb_len + 2 < 6 ) { ++ FT_TRACE2(( " too long fragment length makes" ++ " pfb_len confused: pfb_len=0x%08x\n", pfb_len )); ++ error = FT_Err_Array_Too_Large; ++ goto Exit; ++ } + if ( FT_ALLOC( pfb_data, (FT_Long)pfb_len + 2 ) ) + goto Exit; + +@@ -1587,16 +1610,30 @@ + error = FT_Stream_Seek( stream, offsets[i] ); + if ( error ) + goto Exit2; +- if ( FT_READ_LONG( rlen ) ) +- goto Exit; ++ if ( FT_READ_ULONG( rlen ) ) ++ goto Exit2; ++ ++ /* FT2 allocator takes signed long buffer length, ++ * too large fragment length causing overflow should be checked ++ */ ++ if ( 0x7FFFFFFFUL < rlen ) ++ { ++ error = FT_Err_Invalid_Offset; ++ goto Exit2; ++ } ++ + if ( FT_READ_USHORT( flags ) ) +- goto Exit; ++ goto Exit2; + FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n", + i, offsets[i], rlen, flags )); + ++ error = FT_Err_Array_Too_Large; + /* postpone the check of rlen longer than buffer until FT_Stream_Read() */ + if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */ ++ { ++ FT_TRACE3(( " Skip POST fragment #%d because it is a comment\n", i )); + continue; ++ } + + /* the flags are part of the resource, so rlen >= 2. */ + /* but some fonts declare rlen = 0 for empty fragment */ +@@ -1609,6 +1646,8 @@ + len += rlen; + else + { ++ FT_TRACE3(( " Write POST fragment #%d header (4-byte) to buffer" ++ " 0x%p + 0x%08x\n", i, pfb_data, pfb_lenpos )); + if ( pfb_lenpos + 3 > pfb_len + 2 ) + goto Exit2; + pfb_data[pfb_lenpos ] = (FT_Byte)( len ); +@@ -1619,6 +1658,8 @@ + if ( ( flags >> 8 ) == 5 ) /* End of font mark */ + break; + ++ FT_TRACE3(( " Write POST fragment #%d header (6-byte) to buffer" ++ " 0x%p + 0x%08x\n", i, pfb_data, pfb_pos )); + if ( pfb_pos + 6 > pfb_len + 2 ) + goto Exit2; + pfb_data[pfb_pos++] = 0x80; +@@ -1634,16 +1675,18 @@ + pfb_data[pfb_pos++] = 0; + } + +- error = FT_Err_Cannot_Open_Resource; + if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len ) + goto Exit2; + ++ FT_TRACE3(( " Load POST fragment #%d (%d byte) to buffer" ++ " 0x%p + 0x%08x\n", i, rlen, pfb_data, pfb_pos )); + error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen ); + if ( error ) + goto Exit2; + pfb_pos += rlen; + } + ++ error = FT_Err_Array_Too_Large; + if ( pfb_pos + 2 > pfb_len + 2 ) + goto Exit2; + pfb_data[pfb_pos++] = 0x80; +@@ -1664,6 +1707,13 @@ + aface ); + + Exit2: ++ if ( error == FT_Err_Array_Too_Large ) ++ FT_TRACE2(( " Abort due to too-short buffer to store" ++ " all POST fragments\n" )); ++ else if ( error == FT_Err_Invalid_Offset ) ++ FT_TRACE2(( " Abort due to invalid offset in a POST fragment\n" )); ++ if ( error ) ++ error = FT_Err_Cannot_Open_Resource; + FT_FREE( pfb_data ); + + Exit: +diff -Naur freetype-2.4.11/src/bdf/bdflib.c freetype-2.4.11.new/src/bdf/bdflib.c +--- freetype-2.4.11/src/bdf/bdflib.c 2012-12-16 23:17:39.000000000 +0100 ++++ freetype-2.4.11.new/src/bdf/bdflib.c 2015-02-27 10:15:06.958636400 +0100 +@@ -169,6 +169,18 @@ + sizeof ( _bdf_properties[0] ); + + ++ /* An auxiliary macro to parse properties, to be used in conditionals. */ ++ /* It behaves like `strncmp' but also tests the following character */ ++ /* whether it is a whitespace or NULL. */ ++ /* `property' is a constant string of length `n' to compare with. */ ++#define _bdf_strncmp( name, property, n ) \ ++ ( ft_strncmp( name, property, n ) || \ ++ !( name[n] == ' ' || \ ++ name[n] == '\0' || \ ++ name[n] == '\n' || \ ++ name[n] == '\r' || \ ++ name[n] == '\t' ) ) ++ + /* Auto correction messages. */ + #define ACMSG1 "FONT_ASCENT property missing. " \ + "Added `FONT_ASCENT %hd'.\n" +@@ -1402,7 +1414,7 @@ + + /* If the property happens to be a comment, then it doesn't need */ + /* to be added to the internal hash table. */ +- if ( ft_memcmp( name, "COMMENT", 7 ) != 0 ) ++ if ( _bdf_strncmp( name, "COMMENT", 7 ) != 0 ) + { + /* Add the property to the font property table. */ + error = hash_insert( fp->name, +@@ -1420,13 +1432,13 @@ + /* FONT_ASCENT and FONT_DESCENT need to be assigned if they are */ + /* present, and the SPACING property should override the default */ + /* spacing. */ +- if ( ft_memcmp( name, "DEFAULT_CHAR", 12 ) == 0 ) ++ if ( _bdf_strncmp( name, "DEFAULT_CHAR", 12 ) == 0 ) + font->default_char = fp->value.l; +- else if ( ft_memcmp( name, "FONT_ASCENT", 11 ) == 0 ) ++ else if ( _bdf_strncmp( name, "FONT_ASCENT", 11 ) == 0 ) + font->font_ascent = fp->value.l; +- else if ( ft_memcmp( name, "FONT_DESCENT", 12 ) == 0 ) ++ else if ( _bdf_strncmp( name, "FONT_DESCENT", 12 ) == 0 ) + font->font_descent = fp->value.l; +- else if ( ft_memcmp( name, "SPACING", 7 ) == 0 ) ++ else if ( _bdf_strncmp( name, "SPACING", 7 ) == 0 ) + { + if ( !fp->value.atom ) + { +@@ -1484,7 +1496,7 @@ + memory = font->memory; + + /* Check for a comment. */ +- if ( ft_memcmp( line, "COMMENT", 7 ) == 0 ) ++ if ( _bdf_strncmp( line, "COMMENT", 7 ) == 0 ) + { + linelen -= 7; + +@@ -1501,7 +1513,7 @@ + /* The very first thing expected is the number of glyphs. */ + if ( !( p->flags & _BDF_GLYPHS ) ) + { +- if ( ft_memcmp( line, "CHARS", 5 ) != 0 ) ++ if ( _bdf_strncmp( line, "CHARS", 5 ) != 0 ) + { + FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG1, lineno, "CHARS" )); + error = BDF_Err_Missing_Chars_Field; +@@ -1535,8 +1547,16 @@ + } + + /* Check for the ENDFONT field. */ +- if ( ft_memcmp( line, "ENDFONT", 7 ) == 0 ) ++ if ( _bdf_strncmp( line, "ENDFONT", 7 ) == 0 ) + { ++ if ( p->flags & _BDF_GLYPH_BITS ) ++ { ++ /* Missing ENDCHAR field. */ ++ FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG1, lineno, "ENDCHAR" )); ++ error = BDF_Err_Corrupted_Font_Glyphs; ++ goto Exit; ++ } ++ + /* Sort the glyphs by encoding. */ + ft_qsort( (char *)font->glyphs, + font->glyphs_used, +@@ -1549,7 +1569,7 @@ + } + + /* Check for the ENDCHAR field. */ +- if ( ft_memcmp( line, "ENDCHAR", 7 ) == 0 ) ++ if ( _bdf_strncmp( line, "ENDCHAR", 7 ) == 0 ) + { + p->glyph_enc = 0; + p->flags &= ~_BDF_GLYPH_BITS; +@@ -1565,7 +1585,7 @@ + goto Exit; + + /* Check for the STARTCHAR field. */ +- if ( ft_memcmp( line, "STARTCHAR", 9 ) == 0 ) ++ if ( _bdf_strncmp( line, "STARTCHAR", 9 ) == 0 ) + { + /* Set the character name in the parse info first until the */ + /* encoding can be checked for an unencoded character. */ +@@ -1599,7 +1619,7 @@ + } + + /* Check for the ENCODING field. */ +- if ( ft_memcmp( line, "ENCODING", 8 ) == 0 ) ++ if ( _bdf_strncmp( line, "ENCODING", 8 ) == 0 ) + { + if ( !( p->flags & _BDF_GLYPH ) ) + { +@@ -1785,7 +1805,7 @@ + } + + /* Expect the SWIDTH (scalable width) field next. */ +- if ( ft_memcmp( line, "SWIDTH", 6 ) == 0 ) ++ if ( _bdf_strncmp( line, "SWIDTH", 6 ) == 0 ) + { + if ( !( p->flags & _BDF_ENCODING ) ) + goto Missing_Encoding; +@@ -1801,7 +1821,7 @@ + } + + /* Expect the DWIDTH (scalable width) field next. */ +- if ( ft_memcmp( line, "DWIDTH", 6 ) == 0 ) ++ if ( _bdf_strncmp( line, "DWIDTH", 6 ) == 0 ) + { + if ( !( p->flags & _BDF_ENCODING ) ) + goto Missing_Encoding; +@@ -1829,7 +1849,7 @@ + } + + /* Expect the BBX field next. */ +- if ( ft_memcmp( line, "BBX", 3 ) == 0 ) ++ if ( _bdf_strncmp( line, "BBX", 3 ) == 0 ) + { + if ( !( p->flags & _BDF_ENCODING ) ) + goto Missing_Encoding; +@@ -1897,7 +1917,7 @@ + } + + /* And finally, gather up the bitmap. */ +- if ( ft_memcmp( line, "BITMAP", 6 ) == 0 ) ++ if ( _bdf_strncmp( line, "BITMAP", 6 ) == 0 ) + { + unsigned long bitmap_size; + +@@ -1972,7 +1992,7 @@ + p = (_bdf_parse_t *) client_data; + + /* Check for the end of the properties. */ +- if ( ft_memcmp( line, "ENDPROPERTIES", 13 ) == 0 ) ++ if ( _bdf_strncmp( line, "ENDPROPERTIES", 13 ) == 0 ) + { + /* If the FONT_ASCENT or FONT_DESCENT properties have not been */ + /* encountered yet, then make sure they are added as properties and */ +@@ -2013,12 +2033,12 @@ + } + + /* Ignore the _XFREE86_GLYPH_RANGES properties. */ +- if ( ft_memcmp( line, "_XFREE86_GLYPH_RANGES", 21 ) == 0 ) ++ if ( _bdf_strncmp( line, "_XFREE86_GLYPH_RANGES", 21 ) == 0 ) + goto Exit; + + /* Handle COMMENT fields and properties in a special way to preserve */ + /* the spacing. */ +- if ( ft_memcmp( line, "COMMENT", 7 ) == 0 ) ++ if ( _bdf_strncmp( line, "COMMENT", 7 ) == 0 ) + { + name = value = line; + value += 7; +@@ -2082,7 +2102,7 @@ + + /* Check for a comment. This is done to handle those fonts that have */ + /* comments before the STARTFONT line for some reason. */ +- if ( ft_memcmp( line, "COMMENT", 7 ) == 0 ) ++ if ( _bdf_strncmp( line, "COMMENT", 7 ) == 0 ) + { + if ( p->opts->keep_comments != 0 && p->font != 0 ) + { +@@ -2108,7 +2128,7 @@ + { + memory = p->memory; + +- if ( ft_memcmp( line, "STARTFONT", 9 ) != 0 ) ++ if ( _bdf_strncmp( line, "STARTFONT", 9 ) != 0 ) + { + /* we don't emit an error message since this code gets */ + /* explicitly caught one level higher */ +@@ -2156,7 +2176,7 @@ + } + + /* Check for the start of the properties. */ +- if ( ft_memcmp( line, "STARTPROPERTIES", 15 ) == 0 ) ++ if ( _bdf_strncmp( line, "STARTPROPERTIES", 15 ) == 0 ) + { + if ( !( p->flags & _BDF_FONT_BBX ) ) + { +@@ -2185,7 +2205,7 @@ + } + + /* Check for the FONTBOUNDINGBOX field. */ +- if ( ft_memcmp( line, "FONTBOUNDINGBOX", 15 ) == 0 ) ++ if ( _bdf_strncmp( line, "FONTBOUNDINGBOX", 15 ) == 0 ) + { + if ( !( p->flags & _BDF_SIZE ) ) + { +@@ -2216,7 +2236,7 @@ + } + + /* The next thing to check for is the FONT field. */ +- if ( ft_memcmp( line, "FONT", 4 ) == 0 ) ++ if ( _bdf_strncmp( line, "FONT", 4 ) == 0 ) + { + error = _bdf_list_split( &p->list, (char *)" +", line, linelen ); + if ( error ) +@@ -2251,7 +2271,7 @@ + } + + /* Check for the SIZE field. */ +- if ( ft_memcmp( line, "SIZE", 4 ) == 0 ) ++ if ( _bdf_strncmp( line, "SIZE", 4 ) == 0 ) + { + if ( !( p->flags & _BDF_FONT_NAME ) ) + { +@@ -2305,7 +2325,7 @@ + } + + /* Check for the CHARS field -- font properties are optional */ +- if ( ft_memcmp( line, "CHARS", 5 ) == 0 ) ++ if ( _bdf_strncmp( line, "CHARS", 5 ) == 0 ) + { + char nbuf[128]; + +diff -Naur freetype-2.4.11/src/pcf/pcfread.c freetype-2.4.11.new/src/pcf/pcfread.c +--- freetype-2.4.11/src/pcf/pcfread.c 2012-08-14 09:47:08.000000000 +0200 ++++ freetype-2.4.11.new/src/pcf/pcfread.c 2015-02-27 10:15:06.646618600 +0100 +@@ -78,7 +78,7 @@ + FT_FRAME_START( 16 ), + FT_FRAME_ULONG_LE( type ), + FT_FRAME_ULONG_LE( format ), +- FT_FRAME_ULONG_LE( size ), ++ FT_FRAME_ULONG_LE( size ), /* rounded up to a multiple of 4 */ + FT_FRAME_ULONG_LE( offset ), + FT_FRAME_END + }; +@@ -95,9 +95,11 @@ + FT_Memory memory = FT_FACE(face)->memory; + FT_UInt n; + ++ FT_ULong size; + +- if ( FT_STREAM_SEEK ( 0 ) || +- FT_STREAM_READ_FIELDS ( pcf_toc_header, toc ) ) ++ ++ if ( FT_STREAM_SEEK( 0 ) || ++ FT_STREAM_READ_FIELDS( pcf_toc_header, toc ) ) + return PCF_Err_Cannot_Open_Resource; + + if ( toc->version != PCF_FILE_VERSION || +@@ -151,6 +153,52 @@ + break; + } + ++ /* ++ * We now check whether the `size' and `offset' values are reasonable: ++ * `offset' + `size' must not exceed the stream size. ++ * ++ * Note, however, that X11's `pcfWriteFont' routine (used by the ++ * `bdftopcf' program to create PDF font files) has two special ++ * features. ++ * ++ * - It always assigns the accelerator table a size of 100 bytes in the ++ * TOC, regardless of its real size, which can vary between 34 and 72 ++ * bytes. ++ * ++ * - Due to the way the routine is designed, it ships out the last font ++ * table with its real size, ignoring the TOC's size value. Since ++ * the TOC size values are always rounded up to a multiple of 4, the ++ * difference can be up to three bytes for all tables except the ++ * accelerator table, for which the difference can be as large as 66 ++ * bytes. ++ * ++ */ ++ ++ tables = face->toc.tables; ++ size = stream->size; ++ ++ for ( n = 0; n < toc->count - 1; n++ ) ++ { ++ /* we need two checks to avoid overflow */ ++ if ( ( tables->size > size ) || ++ ( tables->offset > size - tables->size ) ) ++ { ++ error = PCF_Err_Invalid_Table; ++ goto Exit; ++ } ++ tables++; ++ } ++ ++ /* only check `tables->offset' for last table element ... */ ++ if ( ( tables->offset > size ) ) ++ { ++ error = PCF_Err_Invalid_Table; ++ goto Exit; ++ } ++ /* ... and adjust `tables->size' to the real value if necessary */ ++ if ( tables->size > size - tables->offset ) ++ tables->size = size - tables->offset; ++ + #ifdef FT_DEBUG_LEVEL_TRACE + + { +@@ -631,24 +679,40 @@ + return PCF_Err_Out_Of_Memory; + + metrics = face->metrics; +- for ( i = 0; i < nmetrics; i++ ) ++ for ( i = 0; i < nmetrics; i++, metrics++ ) + { +- error = pcf_get_metric( stream, format, metrics + i ); ++ error = pcf_get_metric( stream, format, metrics ); + +- metrics[i].bits = 0; ++ metrics->bits = 0; + + FT_TRACE5(( " idx %d: width=%d, " + "lsb=%d, rsb=%d, ascent=%d, descent=%d, swidth=%d\n", + i, +- ( metrics + i )->characterWidth, +- ( metrics + i )->leftSideBearing, +- ( metrics + i )->rightSideBearing, +- ( metrics + i )->ascent, +- ( metrics + i )->descent, +- ( metrics + i )->attributes )); ++ metrics->characterWidth, ++ metrics->leftSideBearing, ++ metrics->rightSideBearing, ++ metrics->ascent, ++ metrics->descent, ++ metrics->attributes )); + + if ( error ) + break; ++ ++ /* sanity checks -- those values are used in `PCF_Glyph_Load' to */ ++ /* compute a glyph's bitmap dimensions, thus setting them to zero in */ ++ /* case of an error disables this particular glyph only */ ++ if ( metrics->rightSideBearing < metrics->leftSideBearing || ++ metrics->ascent + metrics->descent < 0 ) ++ { ++ metrics->characterWidth = 0; ++ metrics->leftSideBearing = 0; ++ metrics->rightSideBearing = 0; ++ metrics->ascent = 0; ++ metrics->descent = 0; ++ ++ FT_TRACE0(( "pcf_get_metrics:" ++ " invalid metrics for glyph %d\n", i )); ++ } + } + + if ( error ) +@@ -699,8 +763,8 @@ + + FT_TRACE4(( " number of bitmaps: %d\n", nbitmaps )); + +- /* XXX: PCF_Face->nmetrics is singed FT_Long, see pcf.h */ +- if ( face->nmetrics < 0 || nbitmaps != ( FT_ULong )face->nmetrics ) ++ /* XXX: PCF_Face->nmetrics is signed FT_Long, see pcf.h */ ++ if ( face->nmetrics < 0 || nbitmaps != (FT_ULong)face->nmetrics ) + return PCF_Err_Invalid_File_Format; + + if ( FT_NEW_ARRAY( offsets, nbitmaps ) ) +@@ -812,6 +876,15 @@ + if ( !PCF_FORMAT_MATCH( format, PCF_DEFAULT_FORMAT ) ) + return PCF_Err_Invalid_File_Format; + ++ /* sanity checks */ ++ if ( firstCol < 0 || ++ firstCol > lastCol || ++ lastCol > 0xFF || ++ firstRow < 0 || ++ firstRow > lastRow || ++ lastRow > 0xFF ) ++ return PCF_Err_Invalid_Table; ++ + FT_TRACE4(( "pdf_get_encodings:\n" )); + + FT_TRACE4(( " firstCol %d, lastCol %d, firstRow %d, lastRow %d\n", +diff -Naur freetype-2.4.11/src/sfnt/ttcmap.c freetype-2.4.11.new/src/sfnt/ttcmap.c +--- freetype-2.4.11/src/sfnt/ttcmap.c 2012-09-29 09:42:15.000000000 +0200 ++++ freetype-2.4.11.new/src/sfnt/ttcmap.c 2015-02-27 10:15:06.458607800 +0100 +@@ -823,9 +823,6 @@ + FT_Error error = SFNT_Err_Ok; + + +- if ( length < 16 ) +- FT_INVALID_TOO_SHORT; +- + /* in certain fonts, the `length' field is invalid and goes */ + /* out of bound. We try to correct this here... */ + if ( table + length > valid->limit ) +@@ -836,6 +833,9 @@ + length = (FT_UInt)( valid->limit - table ); + } + ++ if ( length < 16 ) ++ FT_INVALID_TOO_SHORT; ++ + p = table + 6; + num_segs = TT_NEXT_USHORT( p ); /* read segCountX2 */ + +@@ -1647,7 +1647,8 @@ + p = is32 + 8192; /* skip `is32' array */ + num_groups = TT_NEXT_ULONG( p ); + +- if ( p + num_groups * 12 > valid->limit ) ++ /* p + num_groups * 12 > valid->limit ? */ ++ if ( num_groups > (FT_UInt32)( valid->limit - p ) / 12 ) + FT_INVALID_TOO_SHORT; + + /* check groups, they must be in increasing order */ +@@ -1672,7 +1673,12 @@ + + if ( valid->level >= FT_VALIDATE_TIGHT ) + { +- if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ) ++ FT_UInt32 d = end - start; ++ ++ ++ /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */ ++ if ( d > TT_VALID_GLYPH_COUNT( valid ) || ++ start_id >= TT_VALID_GLYPH_COUNT( valid ) - d ) + FT_INVALID_GLYPH_ID; + + count = (FT_UInt32)( end - start + 1 ); +@@ -1870,7 +1876,9 @@ + count = TT_NEXT_ULONG( p ); + + if ( length > (FT_ULong)( valid->limit - table ) || +- length < 20 + count * 2 ) ++ /* length < 20 + count * 2 ? */ ++ length < 20 || ++ ( length - 20 ) / 2 < count ) + FT_INVALID_TOO_SHORT; + + /* check glyph indices */ +@@ -2057,7 +2065,9 @@ + num_groups = TT_NEXT_ULONG( p ); + + if ( length > (FT_ULong)( valid->limit - table ) || +- length < 16 + 12 * num_groups ) ++ /* length < 16 + 12 * num_groups ? */ ++ length < 16 || ++ ( length - 16 ) / 12 < num_groups ) + FT_INVALID_TOO_SHORT; + + /* check groups, they must be in increasing order */ +@@ -2079,7 +2089,12 @@ + + if ( valid->level >= FT_VALIDATE_TIGHT ) + { +- if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ) ++ FT_UInt32 d = end - start; ++ ++ ++ /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */ ++ if ( d > TT_VALID_GLYPH_COUNT( valid ) || ++ start_id >= TT_VALID_GLYPH_COUNT( valid ) - d ) + FT_INVALID_GLYPH_ID; + } + +@@ -2381,7 +2396,9 @@ + num_groups = TT_NEXT_ULONG( p ); + + if ( length > (FT_ULong)( valid->limit - table ) || +- length < 16 + 12 * num_groups ) ++ /* length < 16 + 12 * num_groups ? */ ++ length < 16 || ++ ( length - 16 ) / 12 < num_groups ) + FT_INVALID_TOO_SHORT; + + /* check groups, they must be in increasing order */ +@@ -2762,7 +2779,9 @@ + + + if ( length > (FT_ULong)( valid->limit - table ) || +- length < 10 + 11 * num_selectors ) ++ /* length < 10 + 11 * num_selectors ? */ ++ length < 10 || ++ ( length - 10 ) / 11 < num_selectors ) + FT_INVALID_TOO_SHORT; + + /* check selectors, they must be in increasing order */ +@@ -2798,7 +2817,8 @@ + FT_ULong lastBase = 0; + + +- if ( defp + numRanges * 4 > valid->limit ) ++ /* defp + numRanges * 4 > valid->limit ? */ ++ if ( numRanges > (FT_ULong)( valid->limit - defp ) / 4 ) + FT_INVALID_TOO_SHORT; + + for ( i = 0; i < numRanges; ++i ) +@@ -2825,7 +2845,8 @@ + FT_ULong i, lastUni = 0; + + +- if ( numMappings * 4 > (FT_ULong)( valid->limit - ndp ) ) ++ /* numMappings * 4 > (FT_ULong)( valid->limit - ndp ) ? */ ++ if ( numMappings > ( (FT_ULong)( valid->limit - ndp ) ) / 4 ) + FT_INVALID_TOO_SHORT; + + for ( i = 0; i < numMappings; ++i ) +diff -Naur freetype-2.4.11/src/sfnt/ttkern.c freetype-2.4.11.new/src/sfnt/ttkern.c +--- freetype-2.4.11/src/sfnt/ttkern.c 2010-06-30 10:19:16.000000000 +0200 ++++ freetype-2.4.11.new/src/sfnt/ttkern.c 2015-02-27 10:15:06.113588100 +0100 +@@ -99,7 +99,7 @@ + length = FT_NEXT_USHORT( p ); + coverage = FT_NEXT_USHORT( p ); + +- if ( length <= 6 ) ++ if ( length <= 6 + 8 ) + break; + + p_next += length; +diff -Naur freetype-2.4.11/src/sfnt/ttload.c freetype-2.4.11.new/src/sfnt/ttload.c +--- freetype-2.4.11/src/sfnt/ttload.c 2012-12-16 19:07:15.000000000 +0100 ++++ freetype-2.4.11.new/src/sfnt/ttload.c 2015-02-27 10:15:06.420605700 +0100 +@@ -207,7 +207,10 @@ + } + + /* we ignore invalid tables */ +- if ( table.Offset + table.Length > stream->size ) ++ ++ /* table.Offset + table.Length > stream->size ? */ ++ if ( table.Length > stream->size || ++ table.Offset > stream->size - table.Length ) + { + FT_TRACE2(( "check_table_dir: table entry %d invalid\n", nn )); + continue; +@@ -398,7 +401,10 @@ + entry->Length = FT_GET_LONG(); + + /* ignore invalid tables */ +- if ( entry->Offset + entry->Length > stream->size ) ++ ++ /* entry->Offset + entry->Length > stream->size ? */ ++ if ( entry->Length > stream->size || ++ entry->Offset > stream->size - entry->Length ) + continue; + else + { +diff -Naur freetype-2.4.11/src/sfnt/ttsbit0.c freetype-2.4.11.new/src/sfnt/ttsbit0.c +--- freetype-2.4.11/src/sfnt/ttsbit0.c 2009-07-03 15:28:24.000000000 +0200 ++++ freetype-2.4.11.new/src/sfnt/ttsbit0.c 2015-02-27 10:15:06.383603500 +0100 +@@ -228,9 +228,11 @@ + p += 34; + decoder->bit_depth = *p; + +- if ( decoder->strike_index_array > face->sbit_table_size || +- decoder->strike_index_array + 8 * decoder->strike_index_count > +- face->sbit_table_size ) ++ /* decoder->strike_index_array + */ ++ /* 8 * decoder->strike_index_count > face->sbit_table_size ? */ ++ if ( decoder->strike_index_array > face->sbit_table_size || ++ decoder->strike_index_count > ++ ( face->sbit_table_size - decoder->strike_index_array ) / 8 ) + error = SFNT_Err_Invalid_File_Format; + } + +@@ -819,11 +821,11 @@ + image_offset = FT_NEXT_ULONG( p ); + + /* overflow check */ +- if ( decoder->eblc_base + decoder->strike_index_array + image_offset < +- decoder->eblc_base ) ++ p = decoder->eblc_base + decoder->strike_index_array; ++ if ( image_offset > (FT_ULong)( p_limit - p ) ) + goto Failure; + +- p = decoder->eblc_base + decoder->strike_index_array + image_offset; ++ p += image_offset; + if ( p + 8 > p_limit ) + goto NoBitmap; + +@@ -890,11 +892,9 @@ + + num_glyphs = FT_NEXT_ULONG( p ); + +- /* overflow check */ +- if ( p + ( num_glyphs + 1 ) * 4 < p ) +- goto Failure; +- +- if ( p + ( num_glyphs + 1 ) * 4 > p_limit ) ++ /* overflow check for p + ( num_glyphs + 1 ) * 4 */ ++ if ( p + 4 > p_limit || ++ num_glyphs > (FT_ULong)( ( ( p_limit - p ) >> 2 ) - 1 ) ) + goto NoBitmap; + + for ( mm = 0; mm < num_glyphs; mm++ ) +@@ -932,11 +932,8 @@ + + num_glyphs = FT_NEXT_ULONG( p ); + +- /* overflow check */ +- if ( p + 2 * num_glyphs < p ) +- goto Failure; +- +- if ( p + 2 * num_glyphs > p_limit ) ++ /* overflow check for p + 2 * num_glyphs */ ++ if ( num_glyphs > (FT_ULong)( ( p_limit - p ) >> 1 ) ) + goto NoBitmap; + + for ( mm = 0; mm < num_glyphs; mm++ ) +diff -Naur freetype-2.4.11/src/truetype/ttpload.c freetype-2.4.11.new/src/truetype/ttpload.c +--- freetype-2.4.11/src/truetype/ttpload.c 2012-01-02 14:19:15.000000000 +0100 ++++ freetype-2.4.11.new/src/truetype/ttpload.c 2015-02-27 10:15:06.077586000 +0100 +@@ -508,9 +508,9 @@ + record_size = FT_NEXT_ULONG( p ); + + /* The maximum number of bytes in an hdmx device record is the */ +- /* maximum number of glyphs + 2; this is 0xFFFF + 2; this is */ +- /* the reason why `record_size' is a long (which we read as */ +- /* unsigned long for convenience). In practice, two bytes */ ++ /* maximum number of glyphs + 2; this is 0xFFFF + 2, thus */ ++ /* explaining why `record_size' is a long (which we read as */ ++ /* unsigned long for convenience). In practice, two bytes are */ + /* sufficient to hold the size value. */ + /* */ + /* There are at least two fonts, HANNOM-A and HANNOM-B version */ +@@ -522,8 +522,10 @@ + record_size &= 0xFFFFU; + + /* The limit for `num_records' is a heuristic value. */ +- +- if ( version != 0 || num_records > 255 || record_size > 0x10001L ) ++ if ( version != 0 || ++ num_records > 255 || ++ record_size > 0x10001L || ++ record_size < 4 ) + { + error = TT_Err_Invalid_File_Format; + goto Fail; +diff -Naur freetype-2.4.11/src/type1/t1load.c freetype-2.4.11.new/src/type1/t1load.c +--- freetype-2.4.11/src/type1/t1load.c 2012-12-17 07:04:58.000000000 +0100 ++++ freetype-2.4.11.new/src/type1/t1load.c 2015-02-27 10:15:06.343601200 +0100 +@@ -1589,6 +1589,11 @@ + } + + T1_Skip_PS_Token( parser ); ++ if ( parser->root.cursor >= limit ) ++ { ++ error = T1_Err_Invalid_File_Format; ++ goto Fail; ++ } + if ( parser->root.error ) + return; + +@@ -1597,7 +1602,7 @@ + FT_PtrDist len; + + +- if ( cur + 1 >= limit ) ++ if ( cur + 2 >= limit ) + { + error = T1_Err_Invalid_File_Format; + goto Fail; +diff -Naur freetype-2.4.11/src/type42/t42objs.c freetype-2.4.11.new/src/type42/t42objs.c +--- freetype-2.4.11/src/type42/t42objs.c 2012-01-17 11:32:16.000000000 +0100 ++++ freetype-2.4.11.new/src/type42/t42objs.c 2015-02-27 10:15:06.224594400 +0100 +@@ -47,6 +47,12 @@ + if ( FT_ALLOC( face->ttf_data, 12 ) ) + goto Exit; + ++ /* while parsing the font we always update `face->ttf_size' so that */ ++ /* even in case of buggy data (which might lead to premature end of */ ++ /* scanning without causing an error) the call to `FT_Open_Face' in */ ++ /* `T42_Face_Init' passes the correct size */ ++ face->ttf_size = 12; ++ + error = t42_parser_init( parser, + face->root.stream, + memory, +@@ -285,7 +291,9 @@ + FT_Open_Args args; + + +- args.flags = FT_OPEN_MEMORY; ++ args.flags = FT_OPEN_MEMORY | FT_OPEN_DRIVER; ++ args.driver = FT_Get_Module( FT_FACE_LIBRARY( face ), ++ "truetype" ); + args.memory_base = face->ttf_data; + args.memory_size = face->ttf_size; + +diff -Naur freetype-2.4.11/src/type42/t42parse.c freetype-2.4.11.new/src/type42/t42parse.c +--- freetype-2.4.11/src/type42/t42parse.c 2012-11-29 21:05:28.000000000 +0100 ++++ freetype-2.4.11.new/src/type42/t42parse.c 2015-02-27 10:15:06.346601400 +0100 +@@ -498,7 +498,7 @@ + FT_Byte* limit = parser->root.limit; + FT_Error error; + FT_Int num_tables = 0; +- FT_ULong count, ttf_size = 0; ++ FT_ULong count; + + FT_Long n, string_size, old_string_size, real_size; + FT_Byte* string_buf = NULL; +@@ -591,7 +591,7 @@ + + if ( limit - parser->root.cursor < string_size ) + { +- FT_ERROR(( "t42_parse_sfnts: too many binary data\n" )); ++ FT_ERROR(( "t42_parse_sfnts: too much binary data\n" )); + error = T42_Err_Invalid_File_Format; + goto Fail; + } +@@ -631,18 +631,18 @@ + } + else + { +- num_tables = 16 * face->ttf_data[4] + face->ttf_data[5]; +- status = BEFORE_TABLE_DIR; +- ttf_size = 12 + 16 * num_tables; ++ num_tables = 16 * face->ttf_data[4] + face->ttf_data[5]; ++ status = BEFORE_TABLE_DIR; ++ face->ttf_size = 12 + 16 * num_tables; + +- if ( FT_REALLOC( face->ttf_data, 12, ttf_size ) ) ++ if ( FT_REALLOC( face->ttf_data, 12, face->ttf_size ) ) + goto Fail; + } + /* fall through */ + + case BEFORE_TABLE_DIR: + /* the offset table is read; read the table directory */ +- if ( count < ttf_size ) ++ if ( count < face->ttf_size ) + { + face->ttf_data[count++] = string_buf[n]; + continue; +@@ -661,24 +661,23 @@ + len = FT_PEEK_ULONG( p ); + + /* Pad to a 4-byte boundary length */ +- ttf_size += ( len + 3 ) & ~3; ++ face->ttf_size += ( len + 3 ) & ~3; + } + +- status = OTHER_TABLES; +- face->ttf_size = ttf_size; ++ status = OTHER_TABLES; + + /* there are no more than 256 tables, so no size check here */ + if ( FT_REALLOC( face->ttf_data, 12 + 16 * num_tables, +- ttf_size + 1 ) ) ++ face->ttf_size + 1 ) ) + goto Fail; + } + /* fall through */ + + case OTHER_TABLES: + /* all other tables are just copied */ +- if ( count >= ttf_size ) ++ if ( count >= face->ttf_size ) + { +- FT_ERROR(( "t42_parse_sfnts: too many binary data\n" )); ++ FT_ERROR(( "t42_parse_sfnts: too much binary data\n" )); + error = T42_Err_Invalid_File_Format; + goto Fail; + } +@@ -824,6 +823,12 @@ + break; + + T1_Skip_PS_Token( parser ); ++ if ( parser->root.cursor >= limit ) ++ { ++ FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); ++ error = T42_Err_Invalid_File_Format; ++ goto Fail; ++ } + if ( parser->root.error ) + return; + +@@ -832,7 +837,7 @@ + FT_PtrDist len; + + +- if ( cur + 1 >= limit ) ++ if ( cur + 2 >= limit ) + { + FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); + error = T42_Err_Invalid_File_Format; diff --git a/source/lib/freetype2/FrugalBuild b/source/lib/freetype2/FrugalBuild index 9c891c5..50704e7 100644 --- a/source/lib/freetype2/FrugalBuild +++ b/source/lib/freetype2/FrugalBuild @@ -4,7 +4,7 @@ pkgname=freetype2 pkgver=2.4.11 -pkgrel=1 +pkgrel=2 pkgdesc="TrueType font rendering library - 2.0 series (with bytecode interpreter)" groups=('lib') archs=('i686' 'x86_64' 'arm') @@ -21,4 +21,9 @@ source=($source \ signatures=("$source.sig" '' '') Fconfopts+=" --prefix=/usr" +# FSA fix *** +source=(${source[@]} CVE-2014-9656-9675.patch) +signatures=(${signatures[@]} '') +# *********** + # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
