[patch] freetype-1.4_pre20080316-CVE-2007-2754.patch

freetype-1.4_pre20080316-CVE-2007-2754.patch (text/plain), 486 bytes, created by Robert Buchholz (RETIRED) on 2009-05-25 20:11:32 UTC

diff -up freetype-pre1.4/lib/ttgload.c.ttf-overflow freetype-pre1.4/lib/ttgload.c
--- freetype-pre1.4/lib/ttgload.c.ttf-overflow	2009-05-12 19:25:25.000000000 -0400
+++ freetype-pre1.4/lib/ttgload.c	2009-05-12 19:28:15.000000000 -0400
@@ -236,7 +236,7 @@
 
     FORGET_Frame();
 
-    if ( n_points > left_points )
+    if ( n_points < 0  || n_points > left_points )
     {
       PTRACE0(( "ERROR: Too many points in glyph %ld\n", subg->index ));
       return TT_Err_Too_Many_Points;