From: Matthieu Herrb <matthieu@bluenote.herrb.com>

Date: Thu, 17 Jan 2008 14:30:37 +0000 (+0100)

Subject: Fix for CVE-2008-0006 - PCF Font parser buffer overflow.

X-Git-Url: http://gitweb.freedesktop.org/?p=xorg/lib/libXfont.git;a=commitdiff;h=b76df66d2c507898472bba0f9986ef5700029a36

Fix for CVE-2008-0006 - PCF Font parser buffer overflow.

---

--- a/src/bitmap/pcfread.c

+++ b/src/bitmap/pcfread.c

@@ -588,6 +588,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr f

     pFont->info.lastRow = pcfGetINT16(file, format);

     pFont->info.defaultCh = pcfGetINT16(file, format);

     if (IS_EOF(file)) goto Bail;

+    if (pFont->info.firstCol > pFont->info.lastCol ||

+       pFont->info.firstRow > pFont->info.lastRow ||

+       pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail;

     nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) *

 	(pFont->info.lastRow - pFont->info.firstRow + 1);

@@ -726,6 +729,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, F

     pFontInfo->lastRow = pcfGetINT16(file, format);

     pFontInfo->defaultCh = pcfGetINT16(file, format);

     if (IS_EOF(file)) goto Bail;

+    if (pFontInfo->firstCol > pFontInfo->lastCol ||

+       pFontInfo->firstRow > pFontInfo->lastRow ||

+       pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail;

     nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) *

 	(pFontInfo->lastRow - pFontInfo->firstRow + 1);