From 18a8f0d9943369449bc4de92d411c78fb08d616c Mon Sep 17 00:00:00 2001 From: suzuki toshiya Date: Wed, 26 Nov 2014 16:11:38 +0900 Subject: [PATCH] Fix Savannah bug #43540. * src/base/ftmac.c (parse_fond): Prevent a buffer overrun caused by a font including too many (> 63) strings to store names[] table. --- ChangeLog | 8 ++++++++ src/base/ftmac.c | 5 +++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index f0e292cdb..deac0e7e9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2014-11-26 suzuki toshiya + + Fix Savannah bug #43540. + + * src/base/ftmac.c (parse_fond): Prevent a buffer overrun + caused by a font including too many (> 63) strings to store + names[] table. + 2014-11-26 suzuki toshiya * src/base/ftobjs.c (Mac_Read_POST_Resource): Use unsigned long diff --git a/src/base/ftmac.c b/src/base/ftmac.c index 9b49da814..184a2e19f 100644 --- a/src/base/ftmac.c +++ b/src/base/ftmac.c @@ -440,9 +440,10 @@ style = (StyleTable*)p; p += sizeof ( StyleTable ); string_count = EndianS16_BtoN( *(short*)(p) ); + string_count = FT_MIN( 64, string_count ); p += sizeof ( short ); - for ( i = 0; i < string_count && i < 64; i++ ) + for ( i = 0; i < string_count; i++ ) { names[i] = p; p += names[i][0]; @@ -459,7 +460,7 @@ ps_name[ps_name_len] = 0; } if ( style->indexes[face_index] > 1 && - style->indexes[face_index] <= FT_MIN( string_count, 64 ) ) + style->indexes[face_index] <= string_count ) { unsigned char* suffixes = names[style->indexes[face_index] - 1];