<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Heap buffer overflow at cairo-truetype-subset.c:1299, CVE-2017-9814" href="https://bugs.freedesktop.org/show_bug.cgi?id=101547#c12">Comment # 12</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Heap buffer overflow at cairo-truetype-subset.c:1299, CVE-2017-9814" href="https://bugs.freedesktop.org/show_bug.cgi?id=101547">bug 101547</a> from <a class="email" href="mailto:bryce@osg.samsung.com" title="Bryce Harrington <bryce@osg.samsung.com>"> Bryce Harrington</a> <pre>I've gone ahead and rebased and landed Adrian's patch. To ssh://git.freedesktop.org/git/cairo 7554822..1998239 master -> master qzheng's patch demonstrates there are additional malloc()'s worth reviewing as followup work, esp. in boilerplate. However, the patch includes some s/malloc/_cairo_malloc/ changes that don't look quite right, such as: -#include "cairo-malloc-private.h" +#include "cairo-_cairo_malloc-private.h" Some of the changes to tests and docs may not strictly be needed. Also, we have cases of malloc(unsigned + number) which won't ever trigger the malloc(0) error; should we still change these cases for consistency, or leave them as is? I'm going to leave this bug open until at least the mallocs in boilerplate/ have been applied.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>