Hi Werner,
On Tue, 20 Oct 2020 at 09:07, Werner LEMBERG wrote:
I've just fixed a heap buffer overflow that can happen for some
malformed `.ttf` files with PNG sbit glyphs. It seems that this
vulnerability gets already actively used in the wild, so I ask all
users to apply the corresponding commit as soon as possible.
Tomorrow I will do a 2.10.4 release.
Does this vulnerability affect older (< 2.10.3) versions of FreeType as well?
It appears that something like this was fixed with 54abd22891 but the fix there came too late (after a narrowing conversion) leaving some values unchecked. This new change moves that check earlier (to the values actually needing to be checked directly). The code in question hasn't changed much since 2.5.3 and probably back to 2.5.1 is affected.
Werner, I see a commit in the FreeType repo, but it seems to be just a change log entry, probably just didn't 'git add' pngshim.c? (I do things like that embarrassingly frequently.)