[truetype] Avoid segfault for invalid variation data.
* src/truetype/ttgxvar.c (ft_var_load_item_variation_store): Assure `itemCount' is not zero. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=441
This commit is contained in:
parent
15c6e8d6c5
commit
79d52b9a8d
11
ChangeLog
11
ChangeLog
|
@ -1,3 +1,14 @@
|
||||||
|
2017-01-23 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
[truetype] Avoid segfault for invalid variation data.
|
||||||
|
|
||||||
|
* src/truetype/ttgxvar.c (ft_var_load_item_variation_store): Assure
|
||||||
|
`itemCount' is not zero.
|
||||||
|
|
||||||
|
Reported as
|
||||||
|
|
||||||
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=441
|
||||||
|
|
||||||
2017-01-20 Werner Lemberg <wl@gnu.org>
|
2017-01-20 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
* src/truetype/ttinterp.c (TT_RunIns): Adjust loop detector limits.
|
* src/truetype/ttinterp.c (TT_RunIns): Adjust loop detector limits.
|
||||||
|
|
|
@ -431,7 +431,8 @@
|
||||||
|
|
||||||
if ( format != 1 )
|
if ( format != 1 )
|
||||||
{
|
{
|
||||||
FT_TRACE2(( "bad store format %d\n", format ));
|
FT_TRACE2(( "ft_var_load_item_variation_store: bad store format %d\n",
|
||||||
|
format ));
|
||||||
error = FT_THROW( Invalid_Table );
|
error = FT_THROW( Invalid_Table );
|
||||||
goto Exit;
|
goto Exit;
|
||||||
}
|
}
|
||||||
|
@ -441,6 +442,14 @@
|
||||||
FT_READ_USHORT( itemStore->dataCount ) )
|
FT_READ_USHORT( itemStore->dataCount ) )
|
||||||
goto Exit;
|
goto Exit;
|
||||||
|
|
||||||
|
/* we need at least one entry in `itemStore->varData' */
|
||||||
|
if ( !itemStore->dataCount )
|
||||||
|
{
|
||||||
|
FT_TRACE2(( "ft_var_load_item_variation_store: missing varData\n" ));
|
||||||
|
error = FT_THROW( Invalid_Table );
|
||||||
|
goto Exit;
|
||||||
|
}
|
||||||
|
|
||||||
/* make temporary copy of item variation data offsets; */
|
/* make temporary copy of item variation data offsets; */
|
||||||
/* we will parse region list first, then come back */
|
/* we will parse region list first, then come back */
|
||||||
if ( FT_NEW_ARRAY( dataOffsetArray, itemStore->dataCount ) )
|
if ( FT_NEW_ARRAY( dataOffsetArray, itemStore->dataCount ) )
|
||||||
|
|
Loading…
Reference in New Issue