we left existing clients vulnerable until they switched to getFontTable(LETag, size_t&). That was wrong. I wish we had removed getFontTable(LETag) completely such that clients wouldn't compile until they fixed the security issue.
Please do that. Otherwise no one will know how many vulnerabilities will stay unfixed forever. Just finished debugging one bug that came down to a rogue client.
I'm going to remove the single arg version in icu-le-hb, and remove default implementation of the two-arg version.
behdad
Activity
UnicodeBot
June 30, 2018 at 11:43 PM
Trac Comment 1 by behdad@1d5920f4b44b27a8—2014-12-19T00:16:30.045Z
When we fixed the security issue with the getFontTable(LETag):
http://site.icu-project.org/download/51#TOC-Known-Issues
we left existing clients vulnerable until they switched to getFontTable(LETag, size_t&). That was wrong. I wish we had removed getFontTable(LETag) completely such that clients wouldn't compile until they fixed the security issue.
Please do that. Otherwise no one will know how many vulnerabilities will stay unfixed forever. Just finished debugging one bug that came down to a rogue client.
I'm going to remove the single arg version in icu-le-hb, and remove default implementation of the two-arg version.
behdad