cvs: gd /libgd gdft.c

pajoye		Sun May  6 19:01:05 2007 UTC

  Modified files:              
    /gd/libgd	gdft.c 
  Log:
  - MFB:
   - prevent double lock/unlock for the tween colors cache
   - use gdFree not free
   - #40, possible Buffer overflow in the gdImageStringFTEx function
     in gdft.c (CVE-2007-0455) (Kees Cook)
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gdft.c?r1=1.33&r2=1.34&diff_format=u
Index: gd/libgd/gdft.c
diff -u gd/libgd/gdft.c:1.33 gd/libgd/gdft.c:1.34
--- gd/libgd/gdft.c:1.33	Mon Apr 30 03:55:11 2007
+++ gd/libgd/gdft.c	Sun May  6 19:01:04 2007
@@ -783,10 +783,8 @@
 	      /* find antialised color */
 
 	      tc_key.bgcolor = *pixel;
-				gdMutexLock(gdFontCacheMutex);
 	      tc_elem = (tweencolor_t *) gdCacheGet (tc_cache, &tc_key);
 	      *pixel = tc_elem->tweencolor;
-				gdMutexUnlock(gdFontCacheMutex);
 	    }
 	}
     }
@@ -1196,7 +1194,7 @@
 		{
 		  ch = c & 0xFF;	/* don't extend sign */
 		}
-	      next++;
+	      if (*next) next++;
 	    }
 	    break;
 	  case gdFTEX_Big5:
@@ -1590,9 +1588,14 @@
       fullname = gdRealloc (fullname,
                           strlen (fontsearchpath) + strlen (name) + 8);
       /* if name is an absolute or relative pathname then test directly */
+#ifdef NETWARE
+      /* netware uses the format "volume:/path" or the standard "/path" */
+      if (name[0] != 0 && (strstr(name, ":/") || name[0] == '/'))
+#else
       if (strchr (name, '/')
 	  || (name[0] != 0 && name[1] == ':'
 	      && (name[2] == '/' || name[2] == '\\')))
+#endif
 	{
 	  sprintf (fullname, "%s", name);
 	  if (access (fullname, R_OK) == 0)
@@ -1651,7 +1654,7 @@
   gdFree (fontlist);
   if (!font_found)
     {
-      free (fullname);
+      gdFree (fullname);
       return "Could not find/open font";
     }