CONVERTED DATA

BugTraq+ Release Management Values

COMMIT TO FIX:
1.4.1_03
mantis

FIXED IN:
1.4.1_03
mantis

INTEGRATED IN:
1.4.1_03
mantis
mantis-b04


                                     

EVALUATION


In the TT hinting code a buffer is allocated sufficient to hold several
arrays of data which represent information about points and contours of
a glyph outline. The arrays hold data of 1,2 and 4 byte quantities.

Unfortunately the number of byte needed was calculated without any
regard for address alignment requirements, and in particular
an array of 4 byte data was right after an array of 1 byte data.
Thus it was necessary to add the needed padding for this case.
The code is inherently vulnerable to such things but it was sufficient
to fix this one case.
The structure is fnt_ElementType defined in Fnt.c
GlyphOutline.c is where the storage is calculated (ComputeElementSizes)
and  SetElementPointers is the function which sets the pointers to locations
within a buffer allocated to hold that amount of storage.

###@###.### 2002-09-29
============================