From 839cb404cf73f4410d58ebb3a99d16e08f4bdee7 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 16 Jul 2018 05:45:45 +0200 Subject: [PATCH] * src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412 --- ChangeLog | 8 ++++++++ src/truetype/ttgxvar.c | 7 +++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 87f3d1795..9ce63689c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2018-07-16 Werner Lemberg + + * src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412 + 2018-07-12 Werner Lemberg * src/base/ftoutln.c (FT_Outline_Get_Orientation): Init `cbox'. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 0937301b0..d143fcefc 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -2533,11 +2533,14 @@ if ( FT_IS_NAMED_INSTANCE( FT_FACE( face ) ) ) { - FT_UInt idx = (FT_UInt)face->root.face_index >> 16; + FT_UInt instance_index = (FT_UInt)face->root.face_index >> 16; c = blend->normalizedcoords + i; - n = blend->normalized_stylecoords + idx * mmvar->num_axis + i; + n = blend->normalized_stylecoords + + ( instance_index - 1 ) * mmvar->num_axis + + i; + for ( j = i; j < mmvar->num_axis; j++, n++, c++ ) if ( *c != *n ) have_diff = 1;