* src/cid/cidload.c (cid_face_open): Streamline SubrCount check.
This commit is contained in:
parent
0313a11c4c
commit
946df22165
|
@ -902,11 +902,10 @@
|
||||||
goto Exit;
|
goto Exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* `num_subrs' is scanned as a signed integer */
|
/* The first condition prevents the multiplication overflow */
|
||||||
if ( (FT_Int)dict->num_subrs < 0 ||
|
if ( dict->num_subrs > UINT_MAX / 4 ||
|
||||||
( dict->sd_bytes &&
|
dict->num_subrs * dict->sd_bytes >
|
||||||
dict->num_subrs > ( binary_length - dict->subrmap_offset ) /
|
binary_length - dict->subrmap_offset )
|
||||||
dict->sd_bytes ) )
|
|
||||||
{
|
{
|
||||||
FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" ));
|
FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" ));
|
||||||
error = FT_THROW( Invalid_File_Format );
|
error = FT_THROW( Invalid_File_Format );
|
||||||
|
|
Loading…
Reference in New Issue