minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

[sfnt] Fix heap buffer overflow in CPAL handling. 

* src/sfnt/ttcpal.c (tt_face_palette_set): Fix boundary test.
(tt_face_load_cpal): Updated.
This commit is contained in:
Werner Lemberg 2018-09-03 09:00:58 +02:00
parent 9be656bb0c
commit 475f6d25cb
2 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2018-09-03 Werner Lemberg <wl@gnu.org>
[sfnt] Fix heap buffer overflow in CPAL handling.
* src/sfnt/ttcpal.c (tt_face_palette_set): Fix boundary test.
(tt_face_load_cpal): Updated.
2018-09-01 Werner Lemberg <wl@gnu.org> 2018-09-01 Werner Lemberg <wl@gnu.org>
Remove `FT_Outline_{New,Done}_Internal'. Remove `FT_Outline_{New,Done}_Internal'.

15
src/sfnt/ttcpal.c
View File

@ -220,7 +220,8 @@
face->palette_data.num_palette_entries ) ) face->palette_data.num_palette_entries ) )
goto NoCpal; goto NoCpal;
tt_face_palette_set( face, 0 ); if ( tt_face_palette_set( face, 0 ) )
goto InvalidTable;
return FT_Err_Ok; return FT_Err_Ok;
@ -231,6 +232,8 @@
FT_FRAME_RELEASE( table ); FT_FRAME_RELEASE( table );
FT_FREE( cpal ); FT_FREE( cpal );
face->cpal = NULL;
/* arrays in `face->palette_data' and `face->palette' */ /* arrays in `face->palette_data' and `face->palette' */
/* are freed in `sfnt_done_face' */ /* are freed in `sfnt_done_face' */
@ -267,20 +270,20 @@
FT_Color* q; FT_Color* q;
FT_Color* limit; FT_Color* limit;
FT_ULong record_offset; FT_UShort color_index;
if ( !cpal || palette_index >= face->palette_data.num_palettes ) if ( !cpal || palette_index >= face->palette_data.num_palettes )
return FT_THROW( Invalid_Argument ); return FT_THROW( Invalid_Argument );
offset = cpal->color_indices + 2 * palette_index; offset = cpal->color_indices + 2 * palette_index;
record_offset = COLOR_SIZE * FT_PEEK_USHORT( offset ); color_index = FT_PEEK_USHORT( offset );
if ( record_offset + COLOR_SIZE * face->palette_data.num_palette_entries > if ( color_index + face->palette_data.num_palette_entries >
cpal->table_size ) cpal->num_colors )
return FT_THROW( Invalid_Table ); return FT_THROW( Invalid_Table );
p = cpal->colors + record_offset; p = cpal->colors + COLOR_SIZE * color_index;
q = face->palette; q = face->palette;
limit = q + face->palette_data.num_palette_entries; limit = q + face->palette_data.num_palette_entries;