Package: libfreetype6
Version: 2.5.2-3
Severity: important

Dear Maintainer,

Using font FixedSC from http://pts-mini-
gpl.googlecode.com/svn/trunk/fonts/fixedsc.tgz

(libfreetype6_2.5.2-2 was ok)
upgrade to libfreetype6_2.5.2-3
run gnome terminal or terminator
terminal text is corrupt: http://imgur.com/DQZtDBb
downgrade back to libfreetype6_2.5.2-2: terminal text is now ok


The bad patch seems to be: 0020-Fix-Savannah-bug-43547.-CVE-2014-9671.patch:

+    /* we now check whether the `size' and `offset' values are reasonable: */
+    /* `offset' + `size' must not exceed the stream size                   */
+    tables = face->toc.tables;
+    for ( n = 0; n < toc->count; n++ )
+    {
+      /* we need two checks to avoid overflow */
+      if ( ( tables->size   > stream->size                ) ||
+           ( tables->offset > stream->size - tables->size ) )
+      {
+        error = FT_THROW( Invalid_Table );
+        goto Exit;
+      }
+      tables++;
+    }
+


This fails when:

tables->size=100
tables->offset=339968
stream->size=340040
tables->offset > stream->size - tables->size
339968 > 340040-100(=339940)


..xsession-errors:

/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to
create cairo scaled font, expect ugly output. the offending font is 'FixedSC
11'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: font_face
status is: out of memory
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: scaled_font
status is: out of memory
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping
failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC 11',
text='
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: failed to
create cairo scaled font, expect ugly output. the offending font is 'FixedSC
Bold 11'
  self.present()
/usr/share/terminator/terminatorlib/window.py:384: PangoWarning: shaping
failure, expect ugly output. shape-engine='BasicEngineFc', font='FixedSC Bold
11', text='
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
  self.present()



-- System Information:
Debian Release: 8.0
  APT prefers testing-updates
  APT policy: (500, 'testing-updates'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libfreetype6:amd64 depends on:
ii  libc6              2.19-15
ii  libpng12-0         1.2.50-2+b2
ii  multiarch-support  2.19-15
ii  zlib1g             1:1.2.8.dfsg-2+b1

libfreetype6:amd64 recommends no packages.

libfreetype6:amd64 suggests no packages.

-- no debconf information


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Reply via email to