AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/base/ftobj.c (Mac_Read_POST_Resource): Additional

Browse Source 
overflow check in the summation of POST fragment lengths,
suggested by Mateusz Jurczyk <mjurczyk@google.com>.
This commit is contained in:
suzuki toshiya 2014-11-27 00:20:48 +09:00
parent 1720e81e3e
commit cd4a5a26e5
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
* src/base/ftobj.c (Mac_Read_POST_Resource): Additional
overflow check in the summation of POST fragment lengths,
suggested by Mateusz Jurczyk <mjurczyk@google.com>.
2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
* src/base/ftobjs.c (Mac_Read_POST_Resource): Insert comments

7
src/base/ftobjs.c
View File

@ -1586,8 +1586,10 @@
*/
FT_TRACE4(( " POST fragment #%d: length=0x%08x\n",
i, temp));
if ( 0x7FFFFFFFUL < temp )
if ( 0x7FFFFFFFUL < temp || pfb_len + temp + 6 < pfb_len )
{
FT_TRACE2(( " too long fragment length makes"
" pfb_len confused: temp=0x%08x\n", temp ));
error = FT_THROW( Invalid_Offset );
goto Exit;
}
@ -1600,8 +1602,7 @@
resource_cnt, pfb_len + 2));
if ( pfb_len + 2 < 6 ) {
FT_TRACE2(( " too long fragment length makes"
" pfb_len confused: 0x%08x\n",
pfb_len ));
" pfb_len confused: pfb_len=0x%08x\n", pfb_len ));
error = FT_THROW( Array_Too_Large );
goto Exit;
}