From 2dc76a46509d1acbbbdf82987a690c0f9f777b92 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 5 Jul 2010 06:40:02 +0200 Subject: [PATCH] [cff] Next try to fix `hintmask' and `cntrmask' limit check. Problem reported by malc . * src/cff/cffgload.c (cff_decoder_parse_charstrings) : It is possible that there is just a single byte after the `hintmask' or `cntrmask', e.g., a `return' instruction. --- ChangeLog | 10 ++++++++++ src/cff/cffgload.c | 10 +++++----- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 888788fc7..42c0698e3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +2010-07-05 Werner Lemberg + + [cff] Next try to fix `hintmask' and `cntrmask' limit check. + + Problem reported by malc . + + * src/cff/cffgload.c (cff_decoder_parse_charstrings) + : It is possible that there is just a single byte + after the `hintmask' or `cntrmask', e.g., a `return' instruction. + 2010-07-04 suzuki toshiya Restrict the number of the charmaps in a rogue-compatible mode. diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c index f81b2f40a..4a5f8f006 100644 --- a/src/cff/cffgload.c +++ b/src/cff/cffgload.c @@ -1339,12 +1339,12 @@ decoder->num_hints += num_args / 2; } - /* In a valid charstring there must be at least three bytes */ - /* after `hintmask' or `cntrmask' (two for a `moveto' */ - /* operator and one for `endchar'). Additionally, there */ - /* must be space for `num_hints' bits. */ + /* In a valid charstring there must be at least one byte */ + /* after `hintmask' or `cntrmask' (e.g., for a `return' */ + /* instruction). Additionally, there must be space for */ + /* `num_hints' bits. */ - if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit ) + if ( ( ip + 1 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit ) goto Syntax_Error; if ( hinter )