rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.

This commit is contained in:
Werner Lemberg 2014-12-11 14:07:29 +01:00
parent c9ca6ffc94
commit 812ed34189
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,3 +1,7 @@
2014-12-11 Werner Lemberg <wl@gnu.org>
* src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.
2014-12-11 Werner Lemberg <wl@gnu.org>
* src/base/ftobjs.c (FT_Get_Glyph_Name): Fix off-by-one check.

7
src/type42/t42parse.c
View File

@ -667,6 +667,13 @@
status = BEFORE_TABLE_DIR;
face->ttf_size = 12 + 16 * num_tables;
if ( (FT_ULong)( limit - parser->root.cursor ) < face->ttf_size )
{
FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" ));
error = FT_THROW( Invalid_File_Format );
goto Fail;
}
if ( FT_REALLOC( face->ttf_data, 12, face->ttf_size ) )
goto Fail;
}