rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/sfnt/sfwoff2.c (reconstruct_glyf): Check `triplet_size'. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18108
This commit is contained in:
Werner Lemberg 2019-10-10 13:11:06 +02:00
parent 1e9229f0fc
commit 545a481a74
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,9 +1,17 @@
2019-10-10 Werner Lemberg <wl@gnu.org>
* src/sfnt/sfwoff2.c (reconstruct_glyf): Check `triplet_size'.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18108
2019-10-09 John Tytgat <John.Tytgat@esko.com>
[cff] Fix FT_FACE_FLAG_GLYPH_NAMES for CFF2 based fonts (#57023).
* src/cff/cffobjs.c (cff_face_init): Don't set FT_FACE_FLAG_GLYPH_NAMES
for CFF2 based fonts.
* src/cff/cffobjs.c (cff_face_init): Don't set
FT_FACE_FLAG_GLYPH_NAMES for CFF2 based fonts.
2019-10-08 Werner Lemberg <wl@gnu.org>

5
src/sfnt/sfwoff2.c
View File

@ -1070,6 +1070,11 @@
flags_buf = stream->base + substreams[FLAG_STREAM].offset;
triplet_buf = stream->base + substreams[GLYPH_STREAM].offset;
if ( substreams[GLYPH_STREAM].size <
( substreams[GLYPH_STREAM].offset -
substreams[GLYPH_STREAM].start ) )
goto Fail;
triplet_size = substreams[GLYPH_STREAM].size -
( substreams[GLYPH_STREAM].offset -
substreams[GLYPH_STREAM].start );