forked from minhngoc25a/freetype2
Adjust table size comparisons (#54242).
* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
This commit is contained in:
parent
6ceeb87f5d
commit
0767d5362f
|
@ -1,3 +1,9 @@
|
||||||
|
2018-07-05 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
Adjust table size comparisons (#54242).
|
||||||
|
|
||||||
|
* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
|
||||||
|
|
||||||
2018-07-05 Werner Lemberg <wl@gnu.org>
|
2018-07-05 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
Fix more 32bit issues (#54208)
|
Fix more 32bit issues (#54208)
|
||||||
|
|
|
@ -112,6 +112,10 @@
|
||||||
cpal->num_colors = FT_NEXT_USHORT( p );
|
cpal->num_colors = FT_NEXT_USHORT( p );
|
||||||
colors_offset = FT_NEXT_ULONG( p );
|
colors_offset = FT_NEXT_ULONG( p );
|
||||||
|
|
||||||
|
if ( CPAL_V0_HEADER_BASE_SIZE +
|
||||||
|
face->palette_data.num_palettes * 2U > table_size )
|
||||||
|
goto InvalidTable;
|
||||||
|
|
||||||
if ( colors_offset >= table_size )
|
if ( colors_offset >= table_size )
|
||||||
goto InvalidTable;
|
goto InvalidTable;
|
||||||
if ( cpal->num_colors * COLOR_SIZE > table_size - colors_offset )
|
if ( cpal->num_colors * COLOR_SIZE > table_size - colors_offset )
|
||||||
|
@ -128,7 +132,9 @@
|
||||||
FT_UShort* q;
|
FT_UShort* q;
|
||||||
|
|
||||||
|
|
||||||
if ( face->palette_data.num_palettes * 2 + 3U * 4 > table_size )
|
if ( CPAL_V0_HEADER_BASE_SIZE +
|
||||||
|
face->palette_data.num_palettes * 2U +
|
||||||
|
3U * 4 > table_size )
|
||||||
goto InvalidTable;
|
goto InvalidTable;
|
||||||
|
|
||||||
p += face->palette_data.num_palettes * 2;
|
p += face->palette_data.num_palettes * 2;
|
||||||
|
|
Loading…
Reference in New Issue