Commit 9f83e055028306dac4103c14f52d7cfdf8adedcf
2007-04-05T02:28:23
* Version 2.3.3 released. ========================= Tag sources with `VER-2-3-3'. * docs/CHANGES: Mention CVE-2007-1351.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
diff --git a/ChangeLog b/ChangeLog
index c15c2aa..f356f81 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2007-04-04 Werner Lemberg <wl@gnu.org>
+
+ * Version 2.3.3 released.
+ =========================
+
+
+ Tag sources with `VER-2-3-3'.
+
+ * docs/CHANGES: Mention CVE-2007-1351.
+
2007-04-03 David Turner <david@freetype.org>
* src/base/ftobjs.c (FT_Set_Char_Size): As suggested by James Cloos,
@@ -27,7 +37,7 @@
* src/bdf/bdflib.c (setsbit, sbitset): Handle values >= 128
gracefully.
(_bdf_set_default_spacing): Increase `name' buffer size to 256 and
- issue an error for longer names.
+ issue an error for longer names. This fixes CVE-2007-1351.
(_bdf_parse_glyphs): Limit allowed number of glyphs in font to the
number of code points in Unicode.
diff --git a/docs/CHANGES b/docs/CHANGES
index dc2fa25..8b76df0 100644
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -18,6 +18,10 @@ CHANGES BETWEEN 2.3.3 and 2.3.2
to 0 for mono-spaced fonts. Otherwise code that uses them would
essentially ruin the fixed-advance property.
+ - Fix CVE-2007-1351 which can cause an integer overflow while
+ parsing BDF fonts, leading to a potentially exploitable heap
+ overflow condition.
+
II. MISCELLANEOUS
- Fixed compilation issues on some 64-bit platforms (see ChangeLog