mirror of
https://gitlab.freedesktop.org/plymouth/plymouth.git
synced 2026-05-15 12:18:10 +02:00
On hidpi screens, label-freetype will trigger a use-after-free in set_font_for_control() via the call in update_scale_factor_from_pixel_buffer(). That call passes label->font as the font parameter to set_font_for_control(). set_font_for_control() then calls strdup() on its font argument, and frees label->font. In this case this causes font to point into freed memory, causing a read use-after-free in the following strstr() and strrchr() calls. Fix the issue by only using the freshly strdup()'d new_font variable after freeing label->font. |
||
|---|---|---|
| .. | ||
| controls | ||
| renderers | ||
| splash | ||
| meson.build | ||