rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Next try to fix `hintmask' and `cntrmask' limit check. 

Problem reported by malc <av1474@comtv.ru>.

* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: It is possible that there is just a single byte
after the `hintmask' or `cntrmask', e.g., a `return' instruction.
This commit is contained in:
Werner Lemberg 2010-07-05 06:40:02 +02:00
parent 0ae3271814
commit 2dc76a4650
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,3 +1,13 @@
2010-07-05 Werner Lemberg <wl@gnu.org>
[cff] Next try to fix `hintmask' and `cntrmask' limit check.
Problem reported by malc <av1474@comtv.ru>.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: It is possible that there is just a single byte
after the `hintmask' or `cntrmask', e.g., a `return' instruction.
2010-07-04 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
Restrict the number of the charmaps in a rogue-compatible mode.

10
src/cff/cffgload.c
View File

@ -1339,12 +1339,12 @@
decoder->num_hints += num_args / 2;
}
/* In a valid charstring there must be at least three bytes */
/* after `hintmask' or `cntrmask' (two for a `moveto' */
/* operator and one for `endchar'). Additionally, there */
/* must be space for `num_hints' bits. */
/* In a valid charstring there must be at least one byte */
/* after `hintmask' or `cntrmask' (e.g., for a `return' */
/* instruction). Additionally, there must be space for */
/* `num_hints' bits. */
if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
if ( ( ip + 1 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
goto Syntax_Error;
if ( hinter )