AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[woff2] Check whether known tag is in array bounds.

Browse Source 
If table tag is not 0x3f, we expect a value between 0 and 62.  If
this is not the case, exit with errors.

* src/sfnt/sfwoff2/c: Check whether table tag makes sense.

* src/sfnt/woff2tags.c: Return 0 if tag is out of bounds.
This commit is contained in:
Nikhil Ramakrishnan 2019-08-22 16:46:03 +05:30 committed by Werner Lemberg
parent d2681a4977
commit 86803acd2a
3 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2019-08-27 Nikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com>
[woff2] Check whether known tag is in array bounds.
If table tag is not 0x3f, we expect a value between 0 and 62. If
this is not the case, exit with errors.
* src/sfnt/sfwoff2/c: Check whether table tag makes sense.
* src/sfnt/woff2tags.c: Return 0 if tag is out of bounds.
2019-08-27 Nikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com>
* src/sfnt/sfwoff2.c: Improve trace comments.

12
src/sfnt/sfwoff2.c
View File

@ -1760,7 +1760,15 @@
goto Exit;
}
else
{
table->Tag = woff2_known_tags( table->FlagByte & 0x3f );
if ( !table->Tag )
{
FT_ERROR(( "woff2_open_font: Unknown table tag." ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
}
flags = 0;
xform_version = ( table->FlagByte >> 6 ) & 0x03;
@ -1787,7 +1795,7 @@
goto Exit;
if ( table->Tag == TTAG_loca && table->TransformLength )
{
FT_ERROR(( "woff_font_open: Invalid loca `transformLength'.\n" ));
FT_ERROR(( "woff2_open_font: Invalid loca `transformLength'.\n" ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
@ -1795,7 +1803,7 @@
if ( src_offset + table->TransformLength < src_offset )
{
FT_ERROR(( "woff_font_open: invalid WOFF2 table directory.\n" ));
FT_ERROR(( "woff2_open_font: invalid WOFF2 table directory.\n" ));
error = FT_THROW( Invalid_Table );
goto Exit;
}

3
src/sfnt/woff2tags.c
View File

@ -91,6 +91,9 @@
};
if ( index < 0 || index > 62 )
return 0;
return known_tags[index];
}