minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[truetype] Check axis count in HVAR table. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362

* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
(ft_var_load_avar): Fix tracing message.
This commit is contained in:
Werner Lemberg 2016-12-31 21:41:08 +01:00
parent 069083cccd
commit e9a154e700
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
ChangeLog
View File

@ -1,4 +1,15 @@
2016-09-08 Werner Lemberg <wl@gnu.org>
2016-12-31 Werner Lemberg <wl@gnu.org>
[truetype] Check axis count in HVAR table.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362
* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
(ft_var_load_avar): Fix tracing message.
2016-12-30 Werner Lemberg <wl@gnu.org>
* Version 2.7.1 released.
=========================

10
src/truetype/ttgxvar.c
View File

@ -346,7 +346,7 @@
if ( axisCount != (FT_Long)blend->mmvar->num_axis )
{
FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `cvar'\n"
FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `fvar'\n"
" table are different\n" ));
goto Exit;
}
@ -521,6 +521,14 @@
FT_READ_USHORT( itemStore->regionCount ) )
goto Exit;
if ( itemStore->axisCount != (FT_Long)blend->mmvar->num_axis )
{
FT_TRACE2(( "ft_var_load_hvar: number of axes in `hvar' and `fvar'\n"
" table are different\n" ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
if ( FT_NEW_ARRAY( itemStore->varRegionList, itemStore->regionCount ) )
goto Exit;