[sfnt] Pointer sanity checks before reading layer info in 'COLR' v0
* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to read from is within the 'COLR' table. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633
This commit is contained in:
parent
048f2e247c
commit
6d62076ae5
|
@ -481,7 +481,9 @@
|
||||||
iterator->p = colr->layers + offset;
|
iterator->p = colr->layers + offset;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( iterator->layer >= iterator->num_layers )
|
if ( iterator->layer >= iterator->num_layers ||
|
||||||
|
iterator->p < colr->layers ||
|
||||||
|
iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) )
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
*aglyph_index = FT_NEXT_USHORT( iterator->p );
|
*aglyph_index = FT_NEXT_USHORT( iterator->p );
|
||||||
|
|
Loading…
Reference in New Issue