forked from minhngoc25a/freetype2
[psaux] Avoid slow PS font parsing in case of error.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955 * src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even in case of error to avoid potential re-scanning.
This commit is contained in:
parent
2550fc75a5
commit
4dc0d48f7b
13
ChangeLog
13
ChangeLog
|
@ -1,4 +1,15 @@
|
||||||
2018-08-14 Werner Lemberg <wl@gnu.org>
|
2018-08-18 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
[psaux] Avoid slow PS font parsing in case of error.
|
||||||
|
|
||||||
|
Reported as
|
||||||
|
|
||||||
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955
|
||||||
|
|
||||||
|
* src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even
|
||||||
|
in case of error to avoid potential re-scanning.
|
||||||
|
|
||||||
|
2018-08-18 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
[cff] Fix heap buffer overflow in old engine.
|
[cff] Fix heap buffer overflow in old engine.
|
||||||
|
|
||||||
|
|
|
@ -1447,6 +1447,8 @@
|
||||||
bytes,
|
bytes,
|
||||||
max_bytes );
|
max_bytes );
|
||||||
|
|
||||||
|
parser->cursor = cur;
|
||||||
|
|
||||||
if ( delimiters )
|
if ( delimiters )
|
||||||
{
|
{
|
||||||
if ( cur < parser->limit && *cur != '>' )
|
if ( cur < parser->limit && *cur != '>' )
|
||||||
|
@ -1456,11 +1458,9 @@
|
||||||
goto Exit;
|
goto Exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
cur++;
|
parser->cursor++;
|
||||||
}
|
}
|
||||||
|
|
||||||
parser->cursor = cur;
|
|
||||||
|
|
||||||
Exit:
|
Exit:
|
||||||
return error;
|
return error;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue