mirror of
https://gitlab.freedesktop.org/plymouth/plymouth.git
synced 2026-05-15 11:08:11 +02:00
dcf23c0adc
On hidpi screens, label-freetype will trigger a use-after-free in set_font_for_control() via the call in update_scale_factor_from_pixel_buffer(). That call passes label->font as the font parameter to set_font_for_control(). set_font_for_control() then calls strdup() on its font argument, and frees label->font. In this case this causes font to point into freed memory, causing a read use-after-free in the following strstr() and strrchr() calls. Fix the issue by only using the freshly strdup()'d new_font variable after freeing label->font. |
||
|---|---|---|
| .. | ||
| client | ||
| libply | ||
| libply-splash-core | ||
| libply-splash-graphics | ||
| plugins | ||
| upstart-bridge | ||
| main.c | ||
| meson.build | ||
| ply-boot-protocol.h | ||
| ply-boot-server.c | ||
| ply-boot-server.h | ||
| ply-splash-core.pc.in | ||
| ply-splash-graphics.pc.in | ||
| plymouthd-fd-escrow.c | ||
| plymouthd.conf | ||
| plymouthd.defaults | ||