mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-20 08:29:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

freetype: fix CVE-2020-15999, backport from 2.10.4

Browse Source 
(From OE-Core rev: 95b928e68325218508cff8def10e72bbe0051c83)

Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Diego Santa Cruz
2020-11-11 18:56:01 +01:00
committed by Richard Purdie
parent 5232b03e22
commit 7d58c8bed6
2 changed files with 52 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
meta/recipes-graphics/freetype/freetype/0001-sfnt-Fix-heap-buffer-overflow-59308.patch Normal file
View File

@@ -0,0 +1,51 @@
From a3bab162b2ae616074c8877a04556932998aeacd Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Mon, 19 Oct 2020 23:45:28 +0200
Subject: [PATCH] [sfnt] Fix heap buffer overflow (#59308).
This is CVE-2020-15999.
* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.
Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab162b2ae616074c8877a04556932998aeacd]
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
---
src/sfnt/pngshim.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 2e64e5846..f55016122 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -332,6 +332,13 @@
if ( populate_map_and_metrics )
{
+ /* reject too large bitmaps similarly to the rasterizer */
+ if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
+ {
+ error = FT_THROW( Array_Too_Large );
+ goto DestroyExit;
+ }
+
metrics->width = (FT_UShort)imgWidth;
metrics->height = (FT_UShort)imgHeight;
@@ -340,13 +347,6 @@
map->pixel_mode = FT_PIXEL_MODE_BGRA;
map->pitch = (int)( map->width * 4 );
map->num_grays = 256;
-
- /* reject too large bitmaps similarly to the rasterizer */
- if ( map->rows > 0x7FFF || map->width > 0x7FFF )
- {
- error = FT_THROW( Array_Too_Large );
- goto DestroyExit;
- }
}
/* convert palette/gray image to rgb */
--
2.18.4

1
meta/recipes-graphics/freetype/freetype_2.10.2.bb
View File

@@ -14,6 +14,7 @@ LIC_FILES_CHKSUM = "file://docs/LICENSE.TXT;md5=4af6221506f202774ef74f64932878a1
SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/${BPN}/${BP}.tar.xz \
file://use-right-libtool.patch \
file://0001-sfnt-Fix-heap-buffer-overflow-59308.patch \
"
SRC_URI[md5sum] = "7c0d5a39f232d7eb9f9d7da76bf08074"
SRC_URI[sha256sum] = "1543d61025d2e6312e0a1c563652555f17378a204a61e99928c9fcef030a2d8b"