REDHAT-BUG-2509620: High severity X.Org libXfont2 vulnerability

fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small numextents (e.g. 1) followed by a large numchars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.