This is an automated email from the git hooks/post-receive script. x2go pushed a commit to branch release/external-1.15.2.x in repository vcxsrv. commit c833cc9b47becd22b5f6de91d69a467adc57c87d Author: Alan Coopersmith <alan.coopersmith@oracle.com> Date: Fri Feb 6 15:54:00 2015 -0800 bdfReadCharacters: bailout if a char's bitmap cannot be read [CVE-2015-1803] Previously would charge on ahead with a NULL pointer in ci->bits, and then crash later in FontCharInkMetrics() trying to access the bits. Found with afl-1.23b. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Julien Cristau <jcristau@debian.org> (cherry picked from commit 78c2e3d70d29698244f70164428bd2868c0ab34c) --- libXfont/src/bitmap/bdfread.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libXfont/src/bitmap/bdfread.c b/libXfont/src/bitmap/bdfread.c index 6387908..1b29b81 100644 --- a/libXfont/src/bitmap/bdfread.c +++ b/libXfont/src/bitmap/bdfread.c @@ -458,7 +458,10 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState, ci->metrics.descent = -bb; ci->metrics.characterWidth = wx; ci->bits = NULL; - bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes); + if (!bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes)) { + bdfError("could not read bitmap for character '%s'\n", charName); + goto BAILOUT; + } ci++; ndx++; } else -- Alioth's /srv/git/code.x2go.org/vcxsrv.git//..//_hooks_/post-receive-email on /srv/git/code.x2go.org/vcxsrv.git