diff options
| author | flz <flz@FreeBSD.org> | 2008-01-23 20:16:42 +0800 |
|---|---|---|
| committer | flz <flz@FreeBSD.org> | 2008-01-23 20:16:42 +0800 |
| commit | 54088522ddee48b1e1d484a7bf48f34f9eea2b52 (patch) | |
| tree | 046db5e724b4d9e9f0966483ccff9fc8a60109cf /x11-fonts | |
| parent | e512efadb2d20b3407f5a35bbb55bff91cb12658 (diff) | |
| download | freebsd-ports-gnome-54088522ddee48b1e1d484a7bf48f34f9eea2b52.tar.gz freebsd-ports-gnome-54088522ddee48b1e1d484a7bf48f34f9eea2b52.tar.zst freebsd-ports-gnome-54088522ddee48b1e1d484a7bf48f34f9eea2b52.zip | |
Fix PCF Font parser buffer overflow (CVE-2008-0006).
Security: http://www.vuxml.org/freebsd/fe2b6597-c9a4-11dc-8da8-0008a18a9961.html
Diffstat (limited to 'x11-fonts')
| -rw-r--r-- | x11-fonts/libXfont/Makefile | 2 | ||||
| -rw-r--r-- | x11-fonts/libXfont/files/patch-CVE-2008-0006 | 24 |
2 files changed, 25 insertions, 1 deletions
diff --git a/x11-fonts/libXfont/Makefile b/x11-fonts/libXfont/Makefile index 5e57f7cf2fff..685b241a56f1 100644 --- a/x11-fonts/libXfont/Makefile +++ b/x11-fonts/libXfont/Makefile @@ -7,7 +7,7 @@ PORTNAME= libXfont PORTVERSION= 1.3.1 -PORTREVISION= 1 +PORTREVISION= 2 PORTEPOCH= 1 CATEGORIES= x11-fonts diff --git a/x11-fonts/libXfont/files/patch-CVE-2008-0006 b/x11-fonts/libXfont/files/patch-CVE-2008-0006 new file mode 100644 index 000000000000..95f7b2f28019 --- /dev/null +++ b/x11-fonts/libXfont/files/patch-CVE-2008-0006 @@ -0,0 +1,24 @@ +diff --git src/bitmap/pcfread.c src/bitmap/pcfread.c +index fd41849..c5db255 100644 +--- src/bitmap/pcfread.c ++++ src/bitmap/pcfread.c +@@ -588,6 +588,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr file, + pFont->info.lastRow = pcfGetINT16(file, format); + pFont->info.defaultCh = pcfGetINT16(file, format); + if (IS_EOF(file)) goto Bail; ++ if (pFont->info.firstCol > pFont->info.lastCol || ++ pFont->info.firstRow > pFont->info.lastRow || ++ pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail; + + nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) * + (pFont->info.lastRow - pFont->info.firstRow + 1); +@@ -726,6 +729,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, FontFilePtr file) + pFontInfo->lastRow = pcfGetINT16(file, format); + pFontInfo->defaultCh = pcfGetINT16(file, format); + if (IS_EOF(file)) goto Bail; ++ if (pFontInfo->firstCol > pFontInfo->lastCol || ++ pFontInfo->firstRow > pFontInfo->lastRow || ++ pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail; + + nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) * + (pFontInfo->lastRow - pFontInfo->firstRow + 1); |