* src/type1/t1load.c (parse_subrs): Fix limit check.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
This commit is contained in:
parent
c5f1bc4b36
commit
5614090725
|
@ -1,3 +1,11 @@
|
||||||
|
2016-10-26 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
* src/type1/t1load.c (parse_subrs): Fix limit check.
|
||||||
|
|
||||||
|
Reported as
|
||||||
|
|
||||||
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
|
||||||
|
|
||||||
2016-10-25 Alexei Podtelezhnikov <apodtele@gmail.com>
|
2016-10-25 Alexei Podtelezhnikov <apodtele@gmail.com>
|
||||||
|
|
||||||
[cff] Correct cmap format reporting (#24819).
|
[cff] Correct cmap format reporting (#24819).
|
||||||
|
|
|
@ -1433,7 +1433,7 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
/* we certainly need more than 8 bytes per subroutine */
|
/* we certainly need more than 8 bytes per subroutine */
|
||||||
if ( parser->root.limit > parser->root.cursor &&
|
if ( parser->root.limit >= parser->root.cursor &&
|
||||||
num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
|
num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
|
||||||
{
|
{
|
||||||
/*
|
/*
|
||||||
|
|
Loading…
Reference in New Issue