Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
Summary: FreeType 2.3.8 is not binary compatible to version 2.3.7
https://bugzilla.redhat.com/show_bug.cgi?id=489928
Summary: FreeType 2.3.8 is not binary compatible to version 2.3.7 Product: Fedora Version: rawhide Platform: All URL: http://sourceforge.net/project/shownotes.php?group_id= 3157&release_id=667610 OS/Version: Linux Status: NEW Severity: urgent Priority: low Component: freetype AssignedTo: besfahbo@redhat.com ReportedBy: xose.vazquez@gmail.com QAContact: extras-qa@fedoraproject.org CC: besfahbo@redhat.com, kevin@tigcc.ticalc.org, fedora-fonts-bugs-list@redhat.com Classification: Fedora
- Very unfortunately, FreeType 2.3.8 contained a change that broke its official ABI. The end result is that programs compiled against previous versions of the library, but dynamically linked to 2.3.8 can experience memory corruption if they call the `FT_Get_PS_Font_Info' function.
We recommend all users to upgrade to 2.3.9 as soon as possible, or to downgrade to a previous release of the library if this is not an option.
The origin of the bug is that a new field was added to the publicly defined `PS_FontInfoRec' structure. Unfortunately, objects of this type can be stack or heap allocated by callers of `FT_Get_PS_Font_Info', resulting in a memory buffer overwrite with its implementation in 2.3.8.
If you want to know whether your code is vulnerable to this issue, simply search for the substrings `PS_FontInfo' and `PS_Font_Info' in your source code. If none is found, your code is safe and is not affected.
The FreeType team apologizes for the problem.