Bdf_free_font NULL pointer resolution vulnerability in versions earlier than FreeType 2.4.11

Release date:
Updated on:

Affected Systems:
FreeType 2.4.11
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57041
CVE (CAN) ID: CVE-2012-5668
 
FreeType is a popular font function library.
 
When the font rendering engine of versions earlier than FreeType 2.4.11 processes the Glyph BDF font, there is a null pointer unreferencing vulnerability. By providing a specially crafted BDF font file, applications that use the FreeType library will crash when processing these specially crafted fonts.
 
For vulnerability information, see the official fix code:
---------------------------------------------------------------------------
 
2 files changed, 11 insertions, 0 deletions
Diff -- git a/ChangeLog B/ChangeLog
Index f3d12c1... 5c9e7eb 100644
--- A/ChangeLog
++ B/ChangeLog
@-1, 3 + 1, 11 @@
+ 2012-12-15 Werner Lemberg <wl@gnu.org>
+
+ [Bdf] Fix savanner bug #37905.
+
+ * Src/bdf/bdflib. c (_ bdf_parse_start): Reset 'props _ size' to zero in
+ Case of allocation error; this value gets used in a loop in
+ 'Bdf _ free_font '.
+
2012-12-10 Alexei Podtelezhnikov <apodtele@gmail.com>

[Truetype] Scale F_dot_P down.
Diff -- git a/src/bdf/bdflib. c B/src/bdf/bdflib. c
Index ed08a6e .. 8d7f9a0 100644
--- A/src/bdf/bdflib. c
++ B/src/bdf/bdflib. c
@-2169,7 + 2169,10 @@
P-> cnt = p-> font-> props_size = _ bdf_atoul (p-> list. field [1], 0, 10 );

If (FT_NEW_ARRAY (p-> font-> props, p-> cnt ))
+ {
+ P-> font-> props_size = 0;
Goto Exit;
+}

P-> flags | = _ BDF_PROPS;
* Next = _ bdf_parse_properties;
 
---------------------------------------------------------------------------
 
<* Source: Mateusz Jurczyk

Link: https://bugzilla.RedHat.com/show_bug.cgi? Id = 890087
Http://osdir.com/ml/general/2012-12/msg39573.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
FreeType
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit? Id = 9b6b5754b57c12b820e01305eb69b8863a161e5a