? freetype-CVE-2007-2754.diff
Index: freetype-2.2.1.patch
===================================================================
RCS file: /cvs/external/freetype/freetype-2.2.1.patch,v
retrieving revision 1.2
retrieving revision 1.2.14.1
diff -u -u -r1.2 -r1.2.14.1
--- freetype/freetype-2.2.1.patch	3 Aug 2006 14:58:26 -0000	1.2
+++ freetype/freetype-2.2.1.patch	29 May 2007 08:53:50 -0000	1.2.14.1
@@ -24,3 +24,35 @@
 + #endif
   
   /* EOF */
+--- misc/build/freetype-2.2.1/src/truetype/ttgload.c	2007/04/09 08:40:11	1.177
++++ misc/build/freetype-2.2.1/src/truetype/ttgload.c	2007/04/27 17:16:50	1.178
+@@ -271,7 +271,11 @@
+ 
+     n_points = 0;
+     if ( n_contours > 0 )
++    {
+       n_points = cont[-1] + 1;
++      if ( n_points < 0 )
++        goto Invalid_Outline;
++    }
+ 
+     /* note that we will add four phantom points later */
+     error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 );
+@@ -682,7 +686,7 @@
+     FT_GlyphLoader  gloader = loader->gloader;
+     FT_Error        error   = TT_Err_Ok;
+     FT_Outline*     outline;
+-    FT_UInt         n_points;
++    FT_Int          n_points;
+ 
+ 
+     outline  = &gloader->current.outline;
+@@ -709,7 +713,7 @@
+       /* Deltas apply to the unscaled data. */
+       FT_Vector*  deltas;
+       FT_Memory   memory = loader->face->memory;
+-      FT_UInt     i;
++      FT_Int      i;
+ 
+ 
+       error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),
