minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

[cid] Better check of `SubrCount' dictionary entry (#46272). 

* src/cid/cidload.c (cid_face_open): Add more sanity tests for
`fd_bytes', `gd_bytes', `sd_bytes', and `num_subrs'.
This commit is contained in:
Werner Lemberg 2015-10-22 09:26:00 +02:00
parent 5dedbc048f
commit 59ae73fe16
2 changed files with 27 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2015-10-22 Werner Lemberg <wl@gnu.org>
[cid] Better check of `SubrCount' dictionary entry (#46272).
* src/cid/cidload.c (cid_face_open): Add more sanity tests for
`fd_bytes', `gd_bytes', `sd_bytes', and `num_subrs'.
2015-10-21 Werner Lemberg <wl@gnu.org>
[base] Pacify compiler (#46266).

23
src/cid/cidload.c
View File

@ -750,6 +750,14 @@
/* sanity tests */
if ( cid->fd_bytes < 0 || cid->gd_bytes < 0 )
{
FT_ERROR(( "cid_parse_dict:"
" Invalid `FDBytes' or `GDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
/* allow at most 32bit offsets */
if ( cid->fd_bytes > 4 || cid->gd_bytes > 4 )
{
@ -769,6 +777,13 @@
CID_FaceDict dict = cid->font_dicts + n;
if ( dict->sd_bytes < 0 )
{
FT_ERROR(( "cid_parse_dict: Invalid `SDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
if ( dict->sd_bytes > 4 )
{
FT_ERROR(( "cid_parse_dict:"
@ -785,9 +800,11 @@
goto Exit;
}
if ( dict->sd_bytes &&
dict->num_subrs >
( binary_length - dict->subrmap_offset ) / dict->sd_bytes )
/* `num_subrs' is scanned as a signed integer */
if ( (FT_Int)dict->num_subrs < 0 ||
( dict->sd_bytes &&
dict->num_subrs > ( binary_length - dict->subrmap_offset ) /
(FT_UInt)dict->sd_bytes ) )
{
FT_ERROR(( "cid_parse_dict: Invalid `SubrCount' value\n" ));
error = FT_THROW( Invalid_File_Format );