AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Handle multiple `blend' operators in a row correctly.

Browse Source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368

* src/cff/cffload.c (cff_blend_doBlend): Adjust `parser->stack'
pointers into `subFont->blend_stack' after reallocation.
This commit is contained in:
Werner Lemberg 2017-01-01 20:51:55 +01:00
parent 63765a8f2a
commit bdec162d92
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2017-01-01 Werner Lemberg <wl@gnu.org>
[cff] Handle multiple `blend' operators in a row correctly.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368
* src/cff/cffload.c (cff_blend_doBlend): Adjust `parser->stack'
pointers into `subFont->blend_stack' after reallocation.
2017-01-01 Werner Lemberg <wl@gnu.org>
[sfnt] Return correct number of named instances for TTCs.

20
src/cff/cffload.c
View File

@ -1307,6 +1307,10 @@
size = 5 * numBlends; /* add 5 bytes per entry */
if ( subFont->blend_used + size > subFont->blend_alloc )
{
FT_Byte* blend_stack_old = subFont->blend_stack;
FT_Byte* blend_top_old = subFont->blend_top;
/* increase or allocate `blend_stack' and reset `blend_top'; */
/* prepare to append `numBlends' values to the buffer */
if ( FT_REALLOC( subFont->blend_stack,
@ -1316,6 +1320,22 @@
subFont->blend_top = subFont->blend_stack + subFont->blend_used;
subFont->blend_alloc += size;
/* iterate over the parser stack and adjust pointers */
/* if the reallocated buffer has a different address */
if ( blend_stack_old &&
subFont->blend_stack != blend_stack_old )
{
FT_PtrDist offset = subFont->blend_stack - blend_stack_old;
FT_Byte** p;
for ( p = parser->stack; p < parser->top; p++ )
{
if ( *p >= blend_stack_old && *p < blend_top_old )
*p += offset;
}
}
}
subFont->blend_used += size;