ref: 9f83e055028306dac4103c14f52d7cfdf8adedcf
parent: 7478197e0018e12aa40f99229626d25d47ead1fe
author: Werner Lemberg <[email protected]>
date: Wed Apr 4 22:28:23 EDT 2007
* Version 2.3.3 released. ========================= Tag sources with `VER-2-3-3'. * docs/CHANGES: Mention CVE-2007-1351.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2007-04-04 Werner Lemberg <[email protected]>
+
+ * Version 2.3.3 released.
+ =========================
+
+
+ Tag sources with `VER-2-3-3'.
+
+ * docs/CHANGES: Mention CVE-2007-1351.
+
2007-04-03 David Turner <[email protected]>
* src/base/ftobjs.c (FT_Set_Char_Size): As suggested by James Cloos,
@@ -27,7 +37,7 @@
* src/bdf/bdflib.c (setsbit, sbitset): Handle values >= 128
gracefully.
(_bdf_set_default_spacing): Increase `name' buffer size to 256 and
- issue an error for longer names.
+ issue an error for longer names. This fixes CVE-2007-1351.
(_bdf_parse_glyphs): Limit allowed number of glyphs in font to the
number of code points in Unicode.
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -18,6 +18,10 @@
to 0 for mono-spaced fonts. Otherwise code that uses them would
essentially ruin the fixed-advance property.
+ - Fix CVE-2007-1351 which can cause an integer overflow while
+ parsing BDF fonts, leading to a potentially exploitable heap
+ overflow condition.
+
II. MISCELLANEOUS
- Fixed compilation issues on some 64-bit platforms (see ChangeLog