Initial import

1 files changed, 117 insertions, 0 deletions

diff --git a/freetype-2.4.11-CVE-2014-9669.patch b/freetype-2.4.11-CVE-2014-9669.patch
new file mode 100644
index 000000000000..59fe8c3b67cd
--- /dev/null
+++ b/freetype-2.4.11-CVE-2014-9669.patch
@@ -0,0 +1,117 @@
+From 602040b1112c9f94d68e200be59ea7ac3d104565 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Wed, 12 Nov 2014 19:51:20 +0000
+Subject: [sfnt] Fix Savannah bug #43588.
+
+* src/sfnt/ttcmap.c (tt_cmap8_validate, tt_cmap10_validate,
+tt_cmap12_validate, tt_cmap13_validate, tt_cmap14_validate): Protect
+against overflow in additions and multiplications.
+---
+diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
+index f9acf5d..712bd4f 100644
+--- a/src/sfnt/ttcmap.c
++++ b/src/sfnt/ttcmap.c
+@@ -1647,7 +1647,8 @@
+     p          = is32  + 8192;          /* skip `is32' array */
+     num_groups = TT_NEXT_ULONG( p );
+ 
+-    if ( p + num_groups * 12 > valid->limit )
++    /* p + num_groups * 12 > valid->limit ? */
++    if ( num_groups > (FT_UInt32)( valid->limit - p ) / 12 )
+       FT_INVALID_TOO_SHORT;
+ 
+     /* check groups, they must be in increasing order */
+@@ -1672,7 +1673,12 @@
+ 
+         if ( valid->level >= FT_VALIDATE_TIGHT )
+         {
+-          if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) )
++          FT_UInt32  d = end - start;
++
++
++          /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */
++          if ( d > TT_VALID_GLYPH_COUNT( valid )             ||
++               start_id >= TT_VALID_GLYPH_COUNT( valid ) - d )
+             FT_INVALID_GLYPH_ID;
+ 
+           count = (FT_UInt32)( end - start + 1 );
+@@ -1870,7 +1876,9 @@
+     count  = TT_NEXT_ULONG( p );
+ 
+     if ( length > (FT_ULong)( valid->limit - table ) ||
+-         length < 20 + count * 2                     )
++         /* length < 20 + count * 2 ? */
++         length < 20                                 ||
++         ( length - 20 ) / 2 < count                 )
+       FT_INVALID_TOO_SHORT;
+ 
+     /* check glyph indices */
+@@ -2057,7 +2065,9 @@
+     num_groups = TT_NEXT_ULONG( p );
+ 
+     if ( length > (FT_ULong)( valid->limit - table ) ||
+-         length < 16 + 12 * num_groups               )
++         /* length < 16 + 12 * num_groups ? */
++         length < 16                                 ||
++         ( length - 16 ) / 12 < num_groups           )
+       FT_INVALID_TOO_SHORT;
+ 
+     /* check groups, they must be in increasing order */
+@@ -2079,7 +2089,12 @@
+ 
+         if ( valid->level >= FT_VALIDATE_TIGHT )
+         {
+-          if ( start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) )
++          FT_UInt32  d = end - start;
++
++
++          /* start_id + end - start >= TT_VALID_GLYPH_COUNT( valid ) ? */
++          if ( d > TT_VALID_GLYPH_COUNT( valid )             ||
++               start_id >= TT_VALID_GLYPH_COUNT( valid ) - d )
+             FT_INVALID_GLYPH_ID;
+         }
+ 
+@@ -2381,7 +2396,9 @@
+     num_groups = TT_NEXT_ULONG( p );
+ 
+     if ( length > (FT_ULong)( valid->limit - table ) ||
+-         length < 16 + 12 * num_groups               )
++         /* length < 16 + 12 * num_groups ? */
++         length < 16                                 ||
++         ( length - 16 ) / 12 < num_groups           )
+       FT_INVALID_TOO_SHORT;
+ 
+     /* check groups, they must be in increasing order */
+@@ -2762,7 +2779,9 @@
+ 
+ 
+     if ( length > (FT_ULong)( valid->limit - table ) ||
+-         length < 10 + 11 * num_selectors            )
++         /* length < 10 + 11 * num_selectors ? */
++         length < 10                                 ||
++         ( length - 10 ) / 11 < num_selectors        )
+       FT_INVALID_TOO_SHORT;
+ 
+     /* check selectors, they must be in increasing order */
+@@ -2798,7 +2817,8 @@
+           FT_ULong  lastBase  = 0;
+ 
+ 
+-          if ( defp + numRanges * 4 > valid->limit )
++          /* defp + numRanges * 4 > valid->limit ? */
++          if ( numRanges > (FT_ULong)( valid->limit - defp ) / 4 )
+             FT_INVALID_TOO_SHORT;
+ 
+           for ( i = 0; i < numRanges; ++i )
+@@ -2825,7 +2845,8 @@
+           FT_ULong  i, lastUni  = 0;
+ 
+ 
+-          if ( numMappings * 4 > (FT_ULong)( valid->limit - ndp ) )
++          /* numMappings * 4 > (FT_ULong)( valid->limit - ndp ) ? */
++          if ( numMappings > ( (FT_ULong)( valid->limit - ndp ) ) / 4 )
+             FT_INVALID_TOO_SHORT;
+ 
+           for ( i = 0; i < numMappings; ++i )
+--
+cgit v0.9.0.2