From f09b8007e7f6e60e0b9c9665ec632b578ae08b6f Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Thu, 17 Jan 2008 15:29:06 +0100 Subject: [PATCH] Fix for CVE-2008-0006 - PCF Font parser buffer overflow. --- dix/dixfonts.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/dix/dixfonts.c b/dix/dixfonts.c index c21b3ec..7bb2404 100644 --- a/dix/dixfonts.c +++ b/dix/dixfonts.c @@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c) err = BadFontName; goto bail; } + /* check values for firstCol, lastCol, firstRow, and lastRow */ + if (pfont->info.firstCol > pfont->info.lastCol || + pfont->info.firstRow > pfont->info.lastRow || + pfont->info.lastCol - pfont->info.firstCol > 255) { + err = AllocError; + goto bail; + } if (!pfont->fpe) pfont->fpe = fpe; pfont->refcnt++; -- 1.5.3.5