* src/cid/cidload.c (cid_face_open): Streamline CIDCount check.
This commit is contained in:
parent
946df22165
commit
012b4f2d48
|
@ -776,7 +776,6 @@
|
||||||
CID_FaceInfo cid = &face->cid;
|
CID_FaceInfo cid = &face->cid;
|
||||||
|
|
||||||
FT_ULong binary_length;
|
FT_ULong binary_length;
|
||||||
FT_ULong entry_len;
|
|
||||||
|
|
||||||
|
|
||||||
cid_init_loader( &loader, face );
|
cid_init_loader( &loader, face );
|
||||||
|
@ -853,7 +852,24 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
binary_length = face->cid_stream->size - cid->data_offset;
|
binary_length = face->cid_stream->size - cid->data_offset;
|
||||||
entry_len = cid->fd_bytes + cid->gd_bytes;
|
|
||||||
|
if ( cid->cidmap_offset > binary_length )
|
||||||
|
{
|
||||||
|
FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
|
||||||
|
error = FT_THROW( Invalid_File_Format );
|
||||||
|
goto Exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* the initial pre-check prevents the multiplication overflow */
|
||||||
|
if ( cid->cid_count > FT_ULONG_MAX / 8 ||
|
||||||
|
cid->cid_count * ( cid->fd_bytes + cid->gd_bytes ) >
|
||||||
|
binary_length - cid->cidmap_offset )
|
||||||
|
{
|
||||||
|
FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
|
||||||
|
error = FT_THROW( Invalid_File_Format );
|
||||||
|
goto Exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
for ( n = 0; n < cid->num_dicts; n++ )
|
for ( n = 0; n < cid->num_dicts; n++ )
|
||||||
{
|
{
|
||||||
|
@ -902,8 +918,8 @@
|
||||||
goto Exit;
|
goto Exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* The first condition prevents the multiplication overflow */
|
/* the initial pre-check prevents the multiplication overflow */
|
||||||
if ( dict->num_subrs > UINT_MAX / 4 ||
|
if ( dict->num_subrs > FT_UINT_MAX / 4 ||
|
||||||
dict->num_subrs * dict->sd_bytes >
|
dict->num_subrs * dict->sd_bytes >
|
||||||
binary_length - dict->subrmap_offset )
|
binary_length - dict->subrmap_offset )
|
||||||
{
|
{
|
||||||
|
@ -913,22 +929,6 @@
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( cid->cidmap_offset > binary_length )
|
|
||||||
{
|
|
||||||
FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
|
|
||||||
error = FT_THROW( Invalid_File_Format );
|
|
||||||
goto Exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( entry_len &&
|
|
||||||
cid->cid_count >
|
|
||||||
( binary_length - cid->cidmap_offset ) / entry_len )
|
|
||||||
{
|
|
||||||
FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
|
|
||||||
error = FT_THROW( Invalid_File_Format );
|
|
||||||
goto Exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* we can now safely proceed */
|
/* we can now safely proceed */
|
||||||
error = cid_read_subrs( face );
|
error = cid_read_subrs( face );
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue