From 73be9f9ab67842cfbec36ee99e8d2301434c84ca Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 24 Nov 2014 07:30:05 +0100 Subject: [PATCH] [type1, type42] Another fix for Savannah bug #43655. * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c (t42_parse_charstrings): Add another boundary testing. --- ChangeLog | 7 +++++++ src/type1/t1load.c | 5 +++++ src/type42/t42parse.c | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9cf9416c2..c19dbe81e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2014-11-24 Werner Lemberg + + [type1, type42] Another fix for Savannah bug #43655. + + * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c + (t42_parse_charstrings): Add another boundary testing. + 2014-11-24 Werner Lemberg [docmaker] Formatting, copyright, improved documentation. diff --git a/src/type1/t1load.c b/src/type1/t1load.c index caa75bdd2..24b14a8bb 100644 --- a/src/type1/t1load.c +++ b/src/type1/t1load.c @@ -1596,6 +1596,11 @@ } T1_Skip_PS_Token( parser ); + if ( parser->root.cursor >= limit ) + { + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( parser->root.error ) return; diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index daf304d8a..d45c0699a 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -849,6 +849,12 @@ break; T1_Skip_PS_Token( parser ); + if ( parser->root.cursor >= limit ) + { + FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( parser->root.error ) return;