rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Fix handling of `cvar' table data. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53

* src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
indices.
This commit is contained in:
Werner Lemberg 2016-10-14 08:58:17 +02:00
parent 8370295755
commit 7eeaf986b5
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2016-10-14 Werner Lemberg <wl@gnu.org>
[truetype] Fix handling of `cvar' table data.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
* src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
indices.
2016-10-11 Werner Lemberg <wl@gnu.org>
[psaux] Fix handling of invalid flex subrs.

9
src/truetype/ttgxvar.c
View File

@ -1552,10 +1552,15 @@
for ( j = 0; j < point_count; j++ )
{
int pindex = localpoints[j];
FT_Long orig_cvt = face->cvt[pindex];
int pindex;
FT_Long orig_cvt;
pindex = localpoints[j];
if ( (FT_ULong)pindex >= face->cvt_size )
continue;
orig_cvt = face->cvt[pindex];
face->cvt[pindex] = (FT_Short)( orig_cvt +
FT_MulFix( deltas[j], apply ) );