CVE-2014-9663

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4
validates a certain length field before that field’s value is completely
calculated, which allows remote attackers to cause a denial of service
(out-of-bounds read) or possibly have unspecified other impact via a
crafted cmap SFNT table.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://code.google.com/p/google-security-research/issues/detail?id=184&gt;
• <http://savannah.nongnu.org/bugs/?43656&gt;