minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[sfnt] Fix Savannah bug #43589. 

* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
overflow.
This commit is contained in:
Werner Lemberg 2014-11-12 21:06:08 +01:00
parent 602040b111
commit f46add1389
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43589.
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
overflow.
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43588.

6
src/sfnt/sfobjs.c
View File

@ -567,8 +567,10 @@
if ( table->Offset != woff_offset ||
table->Offset + table->CompLength > woff.length ||
sfnt_offset + table->OrigLength > woff.totalSfntSize ||
table->CompLength > woff.length ||
table->Offset > woff.length - table->CompLength ||
table->OrigLength > woff.totalSfntSize ||
sfnt_offset > woff.totalSfntSize - table->OrigLength ||
table->CompLength > table->OrigLength )
{
error = FT_THROW( Invalid_Table );