[truetype] Fix handling of `cvar' table data.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53 * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT indices.
This commit is contained in:
parent
8370295755
commit
7eeaf986b5
11
ChangeLog
11
ChangeLog
|
@ -1,3 +1,14 @@
|
||||||
|
2016-10-14 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
[truetype] Fix handling of `cvar' table data.
|
||||||
|
|
||||||
|
Reported as
|
||||||
|
|
||||||
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
|
||||||
|
|
||||||
|
* src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
|
||||||
|
indices.
|
||||||
|
|
||||||
2016-10-11 Werner Lemberg <wl@gnu.org>
|
2016-10-11 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
[psaux] Fix handling of invalid flex subrs.
|
[psaux] Fix handling of invalid flex subrs.
|
||||||
|
|
|
@ -1552,10 +1552,15 @@
|
||||||
|
|
||||||
for ( j = 0; j < point_count; j++ )
|
for ( j = 0; j < point_count; j++ )
|
||||||
{
|
{
|
||||||
int pindex = localpoints[j];
|
int pindex;
|
||||||
FT_Long orig_cvt = face->cvt[pindex];
|
FT_Long orig_cvt;
|
||||||
|
|
||||||
|
|
||||||
|
pindex = localpoints[j];
|
||||||
|
if ( (FT_ULong)pindex >= face->cvt_size )
|
||||||
|
continue;
|
||||||
|
|
||||||
|
orig_cvt = face->cvt[pindex];
|
||||||
face->cvt[pindex] = (FT_Short)( orig_cvt +
|
face->cvt[pindex] = (FT_Short)( orig_cvt +
|
||||||
FT_MulFix( deltas[j], apply ) );
|
FT_MulFix( deltas[j], apply ) );
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue