1 files changed, 30 insertions, 0 deletions
diff --git a/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
new file mode 100644
index 0000000..bb09eb8
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
@@ -0,0 +1,30 @@
+From f09b8007e7f6e60e0b9c9665ec632b578ae08b6f Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:29:06 +0100
+Subject: [PATCH] Fix for CVE-2008-0006 - PCF Font parser buffer overflow.
+
+---
+ dix/dixfonts.c |    7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index c21b3ec..7bb2404 100644
+--- a/dix/dixfonts.c
++++ b/dix/dixfonts.c
+@@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
+ 	err = BadFontName;
+ 	goto bail;
+     }
++    /* check values for firstCol, lastCol, firstRow, and lastRow */
++    if (pfont->info.firstCol > pfont->info.lastCol ||
++       pfont->info.firstRow > pfont->info.lastRow ||
++       pfont->info.lastCol - pfont->info.firstCol > 255) {
++       err = AllocError;
++       goto bail;
++    }
+     if (!pfont->fpe)
+ 	pfont->fpe = fpe;
+     pfont->refcnt++;
+-- 
+1.5.3.5
+