Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Jun 2008 19:39:21 -0400
From: Josh Bressers <>
Subject: Re: FreeType 2.3.6

On 10 June 2008, Josh Bressers wrote:
> So it seems FreeType 2.3.6 fixes some security issues:
>     - A  bunch of  potential security  problems have  been found.  All
>       users should update.
> Does anyone have a freetype contact who we can try to convince to work with
> the community in the future (or give us patches for these)?

After looking at the iDefense advisory, and through the Freetype changelog,
it looks like this is the changeset we need to fix this:

2008-06-08  Werner Lemberg

        * src/type1/t1parse.h (T1_ParserRec): Make `base_len' and
        `private_len' unsigned.

        * src/type1/t1parse.c (read_pfb_tag): Make `asize' unsigned and
        * read
        it as such.
        (T1_New_Parser, T1_Get_Private_Dict): Make `size' unsigned.

        * src/base/ftstream.c (FT_Stream_Skip): Reject negative values.

        * src/type1/t1load.c (parse_blend_design_positions): Check `n_axis'
        for sane value.
        Fix typo.

        * src/psaux/psobjs.c (ps_table_add): Check `idx' correctly.

        * src/truetype/ttinterp (Ins_SHC): Use BOUNDS() to check

        * src/sfnt/ttload.c (tt_face_load_max_profile): Limit

I'll attach the patch (with comment changes stripped).


View attachment "freetype.patch" of type "text/plain" (5812 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.