minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[sfnt] Fix Savannah bug #43591. 

* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
and multiplication overflow.
This commit is contained in:
Werner Lemberg 2014-11-12 21:42:13 +01:00
parent 677ddf4f1d
commit 257c270bd2
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43591.
* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
and multiplication overflow.
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43590.

8
src/sfnt/ttsbit.c
View File

@ -394,9 +394,11 @@
p += 34;
decoder->bit_depth = *p;
if ( decoder->strike_index_array > face->sbit_table_size ||
decoder->strike_index_array + 8 * decoder->strike_index_count >
face->sbit_table_size )
/* decoder->strike_index_array + */
/* 8 * decoder->strike_index_count > face->sbit_table_size ? */
if ( decoder->strike_index_array > face->sbit_table_size ||
decoder->strike_index_count >
( face->sbit_table_size - decoder->strike_index_array ) / 8 )
error = FT_THROW( Invalid_File_Format );
}