AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/truetype/ttgxvar.c (ft_var_load_gvar): Check `glyphoffsets'.

Browse Source
This commit is contained in:
Werner Lemberg 2018-09-12 07:27:30 +02:00
parent 7b855ed9cf
commit 53c5e4bd87
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,3 +1,7 @@
2018-09-12 Werner Lemberg <wl@gnu.org>
* src/truetype/ttgxvar.c (ft_var_load_gvar): Check `glyphoffsets'.
2018-09-10 Armin Hasitzka <prince.cherusker@gmail.com>
* src/pshinter/pshrec.c (t2_hints_stems): Mask numeric overflow.

29
src/truetype/ttgxvar.c
View File

@ -1531,24 +1531,51 @@
if ( gvar_head.flags & 1 )
{
FT_ULong limit = gvar_start + table_len;
/* long offsets (one more offset than glyphs, to mark size of last) */
if ( FT_FRAME_ENTER( ( blend->gv_glyphcnt + 1 ) * 4L ) )
goto Exit;
for ( i = 0; i <= blend->gv_glyphcnt; i++ )
{
blend->glyphoffsets[i] = offsetToData + FT_GET_ULONG();
/* use `>', not `>=' */
if ( blend->glyphoffsets[i] > limit )
{
FT_TRACE2(( "ft_var_load_gvar:"
" invalid glyph variation data offset for index %d\n",
i ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
}
FT_FRAME_EXIT();
}
else
{
FT_ULong limit = gvar_start + table_len;
/* short offsets (one more offset than glyphs, to mark size of last) */
if ( FT_FRAME_ENTER( ( blend->gv_glyphcnt + 1 ) * 2L ) )
goto Exit;
for ( i = 0; i <= blend->gv_glyphcnt; i++ )
{
blend->glyphoffsets[i] = offsetToData + FT_GET_USHORT() * 2;
/* XXX: Undocumented: `*2'! */
/* use `>', not `>=' */
if ( blend->glyphoffsets[i] > limit )
{
FT_TRACE2(( "ft_var_load_gvar:"
" invalid glyph variation data offset for index %d\n",
i ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
}
FT_FRAME_EXIT();
}