From fefd15118fa643c16a34be889baf79cda1768a0f Mon Sep 17 00:00:00 2001 From: Nikolay Sivov Date: Mon, 20 Feb 2017 02:36:39 +0300 Subject: [PATCH] usp10: Ignore device tables with invalid delta format. Signed-off-by: Nikolay Sivov Signed-off-by: Aric Stewart Signed-off-by: Alexandre Julliard --- dlls/usp10/opentype.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/dlls/usp10/opentype.c b/dlls/usp10/opentype.c index e3aaf164cdd..1ad9c393057 100644 --- a/dlls/usp10/opentype.c +++ b/dlls/usp10/opentype.c @@ -1492,10 +1492,18 @@ static INT GPOS_get_device_table_value(const OT_DeviceTable *DeviceTable, WORD p static const WORD mask[3] = {3,0xf,0xff}; if (DeviceTable && ppem >= GET_BE_WORD(DeviceTable->StartSize) && ppem <= GET_BE_WORD(DeviceTable->EndSize)) { - int format = GET_BE_WORD(DeviceTable->DeltaFormat); + WORD format = GET_BE_WORD(DeviceTable->DeltaFormat); int index = ppem - GET_BE_WORD(DeviceTable->StartSize); int value; - TRACE("device table, format %i, index %i\n",format, index); + + TRACE("device table, format %#x, index %i\n", format, index); + + if (format & ~0x3) + { + WARN("invalid delta format %#x\n", format); + return 0; + } + index = index << format; value = (DeviceTable->DeltaValue[index/sizeof(WORD)] << (index%sizeof(WORD)))&mask[format-1]; TRACE("offset %i, value %i\n",index, value);