AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/type1/t1load.c (parse_subrs): Fix limit check.

Browse Source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
This commit is contained in:
Werner Lemberg 2016-10-26 08:10:59 +02:00
parent c5f1bc4b36
commit 5614090725
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2016-10-26 Werner Lemberg <wl@gnu.org>
* src/type1/t1load.c (parse_subrs): Fix limit check.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
2016-10-25 Alexei Podtelezhnikov <apodtele@gmail.com>
[cff] Correct cmap format reporting (#24819).

2
src/type1/t1load.c
View File

@ -1433,7 +1433,7 @@
}
/* we certainly need more than 8 bytes per subroutine */
if ( parser->root.limit > parser->root.cursor &&
if ( parser->root.limit >= parser->root.cursor &&
num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
{
/*