From 7eeaf986b5ebb43cbbc8368c6e528ac311d87805 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Fri, 14 Oct 2016 08:58:17 +0200 Subject: [PATCH] [truetype] Fix handling of `cvar' table data. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53 * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT indices. --- ChangeLog | 11 +++++++++++ src/truetype/ttgxvar.c | 9 +++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index dc4232f7b..6b54ef04d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,14 @@ +2016-10-14 Werner Lemberg + + [truetype] Fix handling of `cvar' table data. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53 + + * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT + indices. + 2016-10-11 Werner Lemberg [psaux] Fix handling of invalid flex subrs. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 52d612e0f..11b290852 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -1552,10 +1552,15 @@ for ( j = 0; j < point_count; j++ ) { - int pindex = localpoints[j]; - FT_Long orig_cvt = face->cvt[pindex]; + int pindex; + FT_Long orig_cvt; + pindex = localpoints[j]; + if ( (FT_ULong)pindex >= face->cvt_size ) + continue; + + orig_cvt = face->cvt[pindex]; face->cvt[pindex] = (FT_Short)( orig_cvt + FT_MulFix( deltas[j], apply ) );