[Bug 1241552] New: Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552

            Bug ID: 1241552
           Summary: Buffer overrun with pango_ft2_render_layout_line()
                    with undersized FT_Bitmap.
           Product: Fedora
           Version: 22
         Component: pango
          Severity: high
          Assignee: tagoh(a)redhat.com
          Reporter: peter(a)peter-b.co.uk
        QA Contact: extras-qa(a)fedoraproject.org
                CC: fonts-bugs(a)lists.fedoraproject.org,
                    i18n-bugs(a)lists.fedoraproject.org, tagoh(a)redhat.com



Description of problem:

pango installed from the F22 "updates" repo contains a critical bug that causes
a buffer overrun on 64-bit architectures when rendering a glyph into a
FT_Bitmap that is too small.

When pango 1.36.8 is built from source on the same system, no buffer overrun is
observed (using valgrind).

Version-Release number of selected component (if applicable):

pango-1.36.8-5.fc22.x86_64

How reproducible:

Always.

Steps to Reproduce:

See http://quality.runrev.com/show_bug.cgi?id=15581 for detailed instructions
for reproducing, plus logs.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=sySDMND9kU&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552



--- Comment #1 from Peter TB Brett <peter(a)peter-b.co.uk&gt; ---
I ran some more tests.  The following builds contain the buffer overrun bug:

- pango-1.36.8-5.fc22.x86_64 package
- Build from pango-1.36.8.tar.xz archive
- Build from pango git, tag 1.36.8

The following builds do *not* contain the buffer overrun:

- Build from pango git, tag 1.37.0
- Build from pango git, tag 1.37.1

Bisect indicates that the bug is fixed in upstream commit fafc7915:
https://git.gnome.org/browse/pango/commit/?id=fafc7915334be2dc7eb3952ea05...

That patch applies cleanly against 1.36.8, but backporting that patch alone
doesn't appear to fix the issue.

Could 1.37.0 be built and distributed through F22 "updates" repo, please?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=7VqDMVZedH&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552



--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
pango-1.36.8-6.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/pango-1.36.8-6.fc22

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=rAsLYLNHDz&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=HT3dMYHN3p&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552



--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
pango-1.36.8-6.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/pango-1.36.8-6.fc21

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=mKaX8gwqNj&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA



--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
Package pango-1.36.8-6.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing pango-1.36.8-6.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-11370/pango-1.36.8-6....
then log in and leave karma (feedback).

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=wZKsKaCnZe&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
   Fixed In Version|                            |pango-1.36.8-6.fc22
         Resolution|---                         |ERRATA
        Last Closed|                            |2015-07-17 22:10:27



--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
pango-1.36.8-6.fc22 has been pushed to the Fedora 22 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=1Szw90r3Fr&a=cc_unsubscribe

[Bug 1241552] Buffer overrun with pango_ft2_render_layout_line() with undersized FT_Bitmap.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1241552

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|pango-1.36.8-6.fc22         |pango-1.36.8-6.fc21



--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
pango-1.36.8-6.fc21 has been pushed to the Fedora 21 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=dxjcvAbi0s&a=cc_unsubscribe