Commit cda6f49332586926393b93a58e3d4a7537d57e6a

David Turner 2009-03-03T20:49:32

Update documentation and bump version number to 2.3.9 * include/freetype/freetype.h: bump patch version to 9 * docs/CHANGES: document the ABI break in 2.3.8 * docs/VERSION.DLL: update version numbers table for 2.3.9 * builds/unix/configure.ac: update AC_INIT and version_info numbers.

diff --git a/ChangeLog b/ChangeLog
index b14357b..5400cd0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,20 @@
 2009-03-03  David Turner  <david@freetype.org>
 
+	Update documentation and bump version number to 2.3.9
+
+	* include/freetype/freetype.h: bump patch version to 9
+	* docs/CHANGES: document the ABI break in 2.3.8
+	* docs/VERSION.DLL: update version numbers table for 2.3.9
+	* builds/unix/configure.ac: update AC_INIT and version_info
+	numbers.
+
+2009-03-03  David Turner  <david@freetype.org>
+
 	Remove ABI-breaking field in public PS_InfoFontRec definition.
 	Instead, we define a new internal PS_FontExtraRec structure to
 	hold the additionnal field, then place it in various internal
 	positions of the corresponding FT_Face derived objects.
-	
+
 	* include/freetype/t1tables.h (PS_FontInfoRec): Remove the
 	`fs_type' field from the public structure.
 
@@ -318,7 +328,7 @@
 
 2008-12-22  Steve Grubb
 
-	* builds/unix/ftsystem.c (FT_Stream_Open): Reject zero-length files. 
+	* builds/unix/ftsystem.c (FT_Stream_Open): Reject zero-length files.
 	Patch from Savannah bug #25151.
 
 2008-12-21  Werner Lemberg  <wl@gnu.org>
@@ -586,7 +596,7 @@
 	* devel/ftoption.h, include/freetype/config/ftoption.h
 	[TT_CONFIG_OPTION_BYTECODE_INTERPRETER]: Undefine
 	TT_CONFIG_OPTION_UNPATENTED_HINTING.  This fixes the return value of
-	`FT_Get_TrueType_Engine_Type' (and makes it work as documented). 
+	`FT_Get_TrueType_Engine_Type' (and makes it work as documented).
 	Reported in bug #441638 of bugzilla.novell.com.
 
 	* docs/CHANGES: Document it.
@@ -609,7 +619,7 @@
 
 2008-10-14  Werner Lemberg  <wl@gnu.org>
 
-	* src/cff/cffobjs.c (cff_face_init): Remove compiler warning. 
+	* src/cff/cffobjs.c (cff_face_init): Remove compiler warning.
 	Suggested by Bram Tassyns in Savannah patch #6651.
 
 2008-10-12  Graham Asher  <graham.asher@btinternet.com>
@@ -786,7 +796,7 @@
 	(cff_face_done), src/pfr/pfrobjs.c (pfr_face_done),
 	src/pcf/pcfdrivr.c (PCF_Face_Done), src/cid/cidobjs.c
 	(cid_face_done), src/bdf/bdfdrivr. (BDF_Face_Done),
-	src/sfnt/sfobjs.c (sfnt_face_done): Protect against face == 0. 
+	src/sfnt/sfobjs.c (sfnt_face_done): Protect against face == 0.
 	Reported by Graham Asher.
 
 2008-09-30  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
@@ -1727,7 +1737,7 @@
 
 2008-03-13  Derek Clegg  <dclegg@apple.com>
 
-	* src/truetype/ttgxvar.c (TT_Get_MM_Var): Fix named style loop. 
+	* src/truetype/ttgxvar.c (TT_Get_MM_Var): Fix named style loop.
 	Patch from Savannah bug #22541.
 
 2008-03-03  Masatoshi Kimura  <VYV03354@nifty.ne.jp>
@@ -2030,7 +2040,7 @@
 2007-10-21  Werner Lemberg  <wl@gnu.org>
 
 	* src/sfnt/sfobjs.c (sfnt_load_face): Support bit 9 and prepare
-	support for bit 8 of the `fsSelection' field in the `OS/2' table. 
+	support for bit 8 of the `fsSelection' field in the `OS/2' table.
 	MS is already using this; hopefully, this becomes part of OpenType
 	1.5.
 	Prepare also support for `name' IDs 21 (WWS_FAMILY) and 22
@@ -4331,7 +4341,7 @@
 	Jens:
 	http://lists.nongnu.org/archive/html/freetype-devel/2006-08/msg00004.htm.
 
-	* src/otvalid/otvmod.c: Replace `ft_validator_run' by `ft_setjmp'. 
+	* src/otvalid/otvmod.c: Replace `ft_validator_run' by `ft_setjmp'.
 	It reverts the change introduced on 2005-08-20.
 
 	* src/gxvalid/gxvmod.c: Ditto.
@@ -4350,7 +4360,7 @@
 
 	* src/cid/cidtoken.h: Adjust invocations of T1_FIELD_XXX.
 
-	* src/psaux/psobjs.c: Add macro FT_COMPONENT for tracing. 
+	* src/psaux/psobjs.c: Add macro FT_COMPONENT for tracing.
 	(ps_parser_to_token): Report a PostScript key as T1_TOKEN_TYPE_KEY,
 	not T1_TOKEN_TYPE_ANY.
 	(ps_parser_load_field): Make sure a token that should be a string or
@@ -4433,8 +4443,8 @@
 	want to skip the array.
 
 	* src/psaux/t1decode.c (t1_decoder_parse_charstrings): Add support
-	for (partially commented out) othersubrs 19-25, 27, and 28. 
-	(t1_decoder_init): Initialize new fields `face' and `buildchar'. 
+	for (partially commented out) othersubrs 19-25, 27, and 28.
+	(t1_decoder_init): Initialize new fields `face' and `buildchar'.
 	(t1_decoder_done): Release new field `buildchar'.
 
 	* src/type1/t1load.c (parse_buildchar, parse_private): New
diff --git a/docs/CHANGES b/docs/CHANGES
index 15ba669..cc95363 100644
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -2,6 +2,29 @@ CHANGES BETWEEN 2.3.9 and 2.3.8
 
   I. IMPORTANT BUG FIXES
 
+    - Very unfortunately, FreeType 2.3.8 contained a change that
+      broke its official ABI. The end result is that programs compiled
+      against previous versions of the library, but dynamically linked
+      to 2.3.8 can experience memory corruption if they call the
+      FT_Get_PS_Font_Info() function.
+
+      We recommend all users to upgrade to 2.3.9 as soon as possible,
+      or to downgrade to a previous release of the library if this is
+      not an option.
+
+      The origin of the bug is that a new field was added to the
+      publicly defined PS_FontInfoRec structure. Unfortunately objects
+      of this type can be stack or heap allocated by callers of
+      FT_Get_PS_Font_Info(), resulting in a memory buffer over-write
+      with its implementation in 2.3.8.
+
+      If you want to know if your code is vulnerable to this issue,
+      simply search for the substrings "PS_FontInfo" and
+      "PS_Font_Info" in your source code. If none is found, your code
+      is safe and will not be affected.
+
+      The FreeType team apologizes for the problem.
+
     - The POSIX support  of MacOS resource-fork fonts  (Suitcase fonts
       and LaserWriter Type1 PostScript fonts) was broken in 2.3.8.  If
       FreeType2 is built without Carbon framework, these fonts are not
diff --git a/docs/VERSION.DLL b/docs/VERSION.DLL
index 08e1d2c..6b028b1 100644
--- a/docs/VERSION.DLL
+++ b/docs/VERSION.DLL
@@ -53,6 +53,7 @@ systems, but not all of them:
 
     release    libtool      so
   -------------------------------
+     2.3.9      9.20.3    6.3.20
      2.3.8      9.19.3    6.3.19
      2.3.7      9.18.3    6.3.18
      2.3.6      9.17.3    6.3.17
diff --git a/include/freetype/freetype.h b/include/freetype/freetype.h
index 85ea42d..364388b 100644
--- a/include/freetype/freetype.h
+++ b/include/freetype/freetype.h
@@ -3757,7 +3757,7 @@ FT_BEGIN_HEADER
    */
 #define FREETYPE_MAJOR  2
 #define FREETYPE_MINOR  3
-#define FREETYPE_PATCH  8
+#define FREETYPE_PATCH  9
 
 
   /*************************************************************************/