CVE-2014-9666

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4
proceeds with a count-to-size association without restricting the count
value, which allows remote attackers to cause a denial of service (integer
overflow and out-of-bounds read) or possibly have unspecified other impact
via a crafted embedded bitmap.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://savannah.nongnu.org/bugs/?43591&gt;
• <http://code.google.com/p/google-security-research/issues/detail?id=167&gt;

Notes