From c46b1e2476cc1804c0dd25d463be3c99d58befd7 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Fri, 8 Jul 2011 13:46:42 +0200 Subject: [PATCH] [psaux] Add better argument check for `callothersubr'. * src/psaux/t1decode.c (t1_decoder_parse_charstrings) : Reject negative arguments. --- ChangeLog | 7 +++++++ src/psaux/t1decode.c | 6 ++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 25fb10c7c..c58d6bf6a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2011-07-08 Werner Lemberg + + [psaux] Add better argument check for `callothersubr'. + + * src/psaux/t1decode.c (t1_decoder_parse_charstrings) + : Reject negative arguments. + 2011-07-07 Werner Lemberg [sfnt] Try harder to find non-zero values for ascender and descender. diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c index ea31c51b1..a60ec38af 100644 --- a/src/psaux/t1decode.c +++ b/src/psaux/t1decode.c @@ -4,8 +4,7 @@ /* */ /* PostScript Type 1 decoding routines (body). */ /* */ -/* Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 */ -/* 2010 by */ +/* Copyright 2000-2011 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -687,6 +686,9 @@ subr_no = (FT_Int)( top[1] >> 16 ); arg_cnt = (FT_Int)( top[0] >> 16 ); + if ( arg_cnt < 0 || subr_no < 0 ) + goto Unexpected_OtherSubr; + /***********************************************************/ /* */ /* remove all operands to callothersubr from the stack */