freetype (2.4.2-2.1+squeeze4) CVE-2011-3256.patch

diff --git a/include/freetype/config/ftstdlib.h b/include/freetype/config/ftstdlib.h
index 30ec14e..11d5d0e 100644
--- a/include/freetype/config/ftstdlib.h
+++ b/include/freetype/config/ftstdlib.h
@@ -59,11 +59,12 @@
 
 #include <limits.h>
 
-#define FT_CHAR_BIT   CHAR_BIT
-#define FT_INT_MAX    INT_MAX
-#define FT_INT_MIN    INT_MIN
-#define FT_UINT_MAX   UINT_MAX
-#define FT_ULONG_MAX  ULONG_MAX
+#define FT_CHAR_BIT    CHAR_BIT
+#define FT_USHORT_MAX  USHRT_MAX
+#define FT_INT_MAX     INT_MAX
+#define FT_INT_MIN     INT_MIN
+#define FT_UINT_MAX    UINT_MAX
+#define FT_ULONG_MAX   ULONG_MAX
 
 
   /**********************************************************************/
diff --git a/src/base/ftbitmap.c b/src/base/ftbitmap.c
index 22ec337..5ef7ac7 100644
--- a/src/base/ftbitmap.c
+++ b/src/base/ftbitmap.c
@@ -417,6 +417,10 @@
 
         target->pitch = source->width + pad;
 
+        if ( target->pitch > 0                           &&
+             target->rows > FT_ULONG_MAX / target->pitch )
+          return FT_Err_Invalid_Argument;
+
         if ( target->rows * target->pitch > old_size             &&
              FT_QREALLOC( target->buffer,
                           old_size, target->rows * target->pitch ) )
diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c
index 90874f0..b3ccbdd 100644
--- a/src/psaux/t1decode.c
+++ b/src/psaux/t1decode.c
@@ -764,6 +764,13 @@
             if ( arg_cnt != 0 )
               goto Unexpected_OtherSubr;
 
+            if ( decoder->flex_state == 0 )
+            {
+              FT_ERROR(( "t1_decoder_parse_charstrings:"
+                         " missing flex start\n" ));
+              goto Syntax_Error;
+            }
+
             /* note that we should not add a point for index 0; */
             /* this will move our current position to the flex  */
             /* point without adding any point to the outline    */
diff --git a/src/raster/ftrend1.c b/src/raster/ftrend1.c
index d8a89f2..28b1b58 100644
--- a/src/raster/ftrend1.c
+++ b/src/raster/ftrend1.c
@@ -176,6 +176,13 @@
 
     width  = (FT_UInt)( ( cbox.xMax - cbox.xMin ) >> 6 );
     height = (FT_UInt)( ( cbox.yMax - cbox.yMin ) >> 6 );
+
+    if ( width > FT_USHORT_MAX || height > FT_USHORT_MAX )
+    {
+      error = Raster_Err_Invalid_Argument;
+      goto Exit;
+    }
+
     bitmap = &slot->bitmap;
     memory = render->root.memory;
 
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 37bbe6d..69b702f 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1474,6 +1474,9 @@
       {
         for ( j = 0; j < point_count; ++j )
         {
+          if ( localpoints[j] >= n_points )
+            continue;
+
           delta_xy[localpoints[j]].x += FT_MulFix( deltas_x[j], apply );
           delta_xy[localpoints[j]].y += FT_MulFix( deltas_y[j], apply );
         }