REDHAT-BUG-496887: Integer Overflow

Will Drewry reported an integer overflow flaw in pango's pangoglyphstringsetsize in pango/glyphstring.c:

61 while (newlen > string->space) 62 { 63 if (string->space == 0) 64 string->space = 1; 65 else 66 string->space = 2; 67 68 if (string->space < 0) 69 { 70 gwarning ("glyph string length overflows maximum integer size, truncated"); 71 newlen = string->space = GMAXINT - 8; 72 } 73 } 74 75 string->glyphs = grealloc (string->glyphs, string->space sizeof (PangoGlyphInfo));

string->space is checked against overflow when doubling it, but is not protected against overflow when multiplied by sizeof(PangoGlyphInfo).

Upstream fix: http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e

Acknowledgements:

Red Hat would like to thank Will Drewry for reporting this issue.