[X2Go-Commits] [vcxsrv] 07/17: bdfReadCharacters: bailout if a char's bitmap cannot be read [CVE-2015-1803]
git-admin at x2go.org
git-admin at x2go.org
Sun Mar 29 16:07:24 CEST 2015
This is an automated email from the git hooks/post-receive script.
x2go pushed a commit to branch release/1.15.2.x
in repository vcxsrv.
commit de7bfbf0e61cdbe5e5c094d8a237cdc87e8b1fc3
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date: Fri Feb 6 15:54:00 2015 -0800
bdfReadCharacters: bailout if a char's bitmap cannot be read [CVE-2015-1803]
Previously would charge on ahead with a NULL pointer in ci->bits, and
then crash later in FontCharInkMetrics() trying to access the bits.
Found with afl-1.23b.
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Reviewed-by: Julien Cristau <jcristau at debian.org>
(cherry picked from commit 78c2e3d70d29698244f70164428bd2868c0ab34c)
---
libXfont/src/bitmap/bdfread.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libXfont/src/bitmap/bdfread.c b/libXfont/src/bitmap/bdfread.c
index 6387908..1b29b81 100644
--- a/libXfont/src/bitmap/bdfread.c
+++ b/libXfont/src/bitmap/bdfread.c
@@ -458,7 +458,10 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
ci->metrics.descent = -bb;
ci->metrics.characterWidth = wx;
ci->bits = NULL;
- bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes);
+ if (!bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes)) {
+ bdfError("could not read bitmap for character '%s'\n", charName);
+ goto BAILOUT;
+ }
ci++;
ndx++;
} else
--
Alioth's /srv/git/code.x2go.org/vcxsrv.git//..//_hooks_/post-receive-email on /srv/git/code.x2go.org/vcxsrv.git
More information about the x2go-commits
mailing list