From bfe53294757b03873b1432b7c1cd3e027802c634 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 27 Oct 2018 00:07:53 +0200 Subject: [PATCH] [psaux] Fix numeric overflow. Triggered by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157 * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix integer overflow. --- ChangeLog | 11 +++++++++++ src/psaux/cffdecode.c | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d96be8497..5bb6ba705 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,14 @@ +2018-10-27 Werner Lemberg + + [psaux] Fix numeric overflow. + + Triggered by + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157 + + * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) + [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix integer overflow. + 2018-10-20 Werner Lemberg Avoid endless loop while tracing (#54858). diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index 58a516fb2..ac1bc1fe2 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -1950,7 +1950,8 @@ if ( num_results < 0 ) goto Syntax_Error; - if ( num_results * (FT_Int)num_designs > num_args ) + if ( num_results > num_args || + num_results * (FT_Int)num_designs > num_args ) goto Stack_Underflow; /* since we currently don't handle interpolation of multiple */