AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

truetype: Check invalid function number in FDEF instruction.

Browse Source
This commit is contained in:
suzuki toshiya 2009-08-01 00:32:17 +09:00
parent 9206eba291
commit d1c23082b6
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
truetype: Check invalid function number in FDEF instruction.
* src/truetype/ttinterp.c (Ins_FDEF): Check
if the operand fits 16-bit function number.
2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
truetype: Truncate the deltas of composite glyph at 16-bit values.

12
src/truetype/ttinterp.c
View File

@ -4290,13 +4290,21 @@
CUR.numFDefs++;
}
/* Although FDEF takes unsigned 32-bit integer, */
/* func # must be within unsigned 16-bit integer */
if ( n > 0xFFFFU )
{
CUR.error = TT_Err_Too_Many_Function_Defs;
return;
}
rec->range = CUR.curRange;
rec->opc = n;
rec->opc = (FT_UInt16)n;
rec->start = CUR.IP + 1;
rec->active = TRUE;
if ( n > CUR.maxFunc )
CUR.maxFunc = n;
CUR.maxFunc = (FT_UInt16)n;
/* Now skip the whole function definition. */
/* We don't allow nested IDEFS & FDEFs. */