Several vulnerabilities have been identified in xfs, the X font
server. The QueryXBitmaps and QueryXExtents protocol requests suffer
from lack of validation of their 'length' parameters. Maliciously
crafted requests can either cause two different problems with both
requests:
* An integer overflow in the computation of the size of a dynamic
buffer can lead to a heap overflow in the build_range() function.
* An arbitrary number of bytes on the heap can be swapped by the
swap_char2b() function.
