Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
DISCONTINUED:openSUSE:11.1:Update
freetype2
bnc619562_CVE-2010-2497.diff
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File bnc619562_CVE-2010-2497.diff of Package freetype2
From 7d3d2cc4fef72c6be9c454b3809c387e12b44cfc Mon Sep 17 00:00:00 2001 From: Werner Lemberg <wl@gnu.org> Date: Wed, 09 Jun 2010 07:14:09 +0000 Subject: Fix Savannah bug #30082. * src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_callothersubr>: Protect against stack underflow. --- --- freetype-2.3.9/src/smooth/ftgrays.c.orig 2009-01-12 21:07:34.000000000 +0100 +++ freetype-2.3.9/src/smooth/ftgrays.c 2010-08-11 20:01:07.722668337 +0200 @@ -979,45 +979,40 @@ const FT_Vector* control2, const FT_Vector* to ) { - TPos dx, dy, da, db; + TPos dx, dy; + TPos mid_x, mid_y; int top, level; int* levels; FT_Vector* arc; - dx = DOWNSCALE( ras.x ) + to->x - ( control1->x << 1 ); - if ( dx < 0 ) - dx = -dx; - dy = DOWNSCALE( ras.y ) + to->y - ( control1->y << 1 ); - if ( dy < 0 ) - dy = -dy; - if ( dx < dy ) - dx = dy; - da = dx; + /* Calculate midpoint and compare it with start and end. */ + mid_x = ( DOWNSCALE( ras.x ) + to->x + + 3 * ( control1->x + control2->x ) ) / 8; + mid_y = ( DOWNSCALE( ras.y ) + to->y + + 3 * ( control1->y + control2->y ) ) / 8; - dx = DOWNSCALE( ras.x ) + to->x - 3 * ( control1->x + control2->x ); + dx = DOWNSCALE( ras.x ) + to->x - ( mid_x << 1 ); if ( dx < 0 ) dx = -dx; - dy = DOWNSCALE( ras.y ) + to->y - 3 * ( control1->x + control2->y ); + dy = DOWNSCALE( ras.y ) + to->y - ( mid_y << 1 ); if ( dy < 0 ) dy = -dy; if ( dx < dy ) dx = dy; - db = dx; + /* Check whether an approximation with straight lines is sufficient. */ level = 1; - da = da / ras.cubic_level; - db = db / ras.conic_level; - while ( da > 0 || db > 0 ) + dx = dx / ras.conic_level; + while ( dx > 0 ) { - da >>= 2; - db >>= 3; + dx >>= 3; level++; } if ( level <= 1 ) { - TPos to_x, to_y, mid_x, mid_y; + TPos to_x, to_y; to_x = UPSCALE( to->x ); @@ -1076,7 +1071,7 @@ Draw: { - TPos to_x, to_y, mid_x, mid_y; + TPos to_x, to_y; to_x = arc[0].x;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor