[Bug 11237] New: heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

Summary: heap corruption in freetype font loader
           Product: Wine
           Version: 0.9.53.
          Platform: Other
               URL: http://www.bahn.de/p/view/static/spiele/virtuelle_bahnfa
                    hrt.exe
        OS/Version: other
            Status: NEW
          Severity: major
          Priority: P2
         Component: fonts
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

The "Virtuelle Bahnfahrt" Screensaver of the German Rail company
has a heap corruption in its About Dialog.

To reproduce:
- download URL
- install by running "wine virtuelle_bahnfahrt.exe"
- run by:
  cd .wine/drive_c/windows
  wine Virtuelle\ Bahnfahrt.scr

this will result in heap corruption.

I tracked this down to dlls/gdi32/freetype.c, and it loads a bitmap font
which is larger than the requested size.

I will attach a patch that fixes the problem.

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

--- Comment #1 from Marcus Meissner   2008-01-17 16:27:29 ---
Created an attachment (id=10331)
 --> (http://bugs.winehq.org/attachment.cgi?id=10331)
xx.pat

Patch to work around issue.

If you remove the h = height; line, and run with
WINEDEBUG=+heap 
the HeapValidate assertion will trigger.

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

--- Comment #2 from Marcus Meissner   2008-01-17 16:28:20 ---
with the patch applied it will output:
fixme:font:WineEngGetGlyphOutline ft_glyph_format_bitmap (bitmap h=13,target
height=9), setting h=height

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

Marcus Meissner  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #3 from Marcus Meissner   2008-01-21 06:11:27 ---
dmitry, likely something for you or Huw

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

--- Comment #4 from Dmitry Timoshkov   2008-01-21 07:26:18 ---
Could you please re-test with today's git?

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

Marcus Meissner  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #5 from Marcus Meissner   2008-01-21 18:16:39 ---
yes, it is working fine now, thanks!

[Bug 11237] heap corruption in freetype font loader

http://bugs.winehq.org/show_bug.cgi?id=11237

Dan Kegel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #6 from Dan Kegel   2008-01-28 06:09:51 ---
Closing all RESOLVED FIXED bugs older than 0.9.54.