[Bug 611927] freetype: write to non-mapped memory in base/ftojbs.c:1563

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=611927

--- Comment #1 from Vincent Danen  2010-07-06 17:36:47 EDT ---
There is actually 21 crashes reported upstream:

http://savannah.nongnu.org/bugs/index.php?go_report=Apply&group=freetype...
0&history_field=0&history_event=modified&history_date_dayfd=2&history_date_monthfd=7&history_date_yearfd=2010&chunksz=50&spamscore=5&boxoptionwanted=1#options

Roughly half of these are NULL pointer derefs or stack exhaustion.  This bug,
and bug 30083, were noted as being higher risk.