diff --git a/ChangeLog b/ChangeLog index 01e9a7be1..3d782e9de 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2017-03-26 Werner Lemberg + + * src/psaux/psobjs.c (t1_builder_close_contour): Add safety guard. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 + 2017-03-23 Werner Lemberg [psaux] Better protect `flex' handling. diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c index d18e821a9..0baf83686 100644 --- a/src/psaux/psobjs.c +++ b/src/psaux/psobjs.c @@ -1718,6 +1718,14 @@ first = outline->n_contours <= 1 ? 0 : outline->contours[outline->n_contours - 2] + 1; + /* in malformed fonts it can happen that a contour was started */ + /* but no points were added */ + if ( outline->n_contours && first == outline->n_points ) + { + outline->n_contours--; + return; + } + /* We must not include the last point in the path if it */ /* is located on the first point. */ if ( outline->n_points > 1 )