rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[psaux] Fix heap buffer overflow (#46221). 

* src/psaux/t1decode.c (t1_decoder_parse_charstring) <operator 12>:
Fix limit check.
This commit is contained in:
Werner Lemberg 2015-10-17 08:11:16 +02:00
parent a5ecfb4ce6
commit 8edfcbed53
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,4 +1,11 @@
2015-10-15 Werner Lemberg <wl@gnu.org>
2015-10-17 Werner Lemberg <wl@gnu.org>
[psaux] Fix heap buffer overflow (#46221).
* src/psaux/t1decode.c (t1_decoder_parse_charstring) <operator 12>:
Fix limit check.
2015-10-17 Werner Lemberg <wl@gnu.org>
* src/cid/cidload.c (cid_parse_dict): Handle invalid input (#46220).

2
src/psaux/t1decode.c
View File

@ -512,7 +512,7 @@
break;
case 12:
if ( ip > limit )
if ( ip >= limit )
{
FT_ERROR(( "t1_decoder_parse_charstrings:"
" invalid escape (12+EOF)\n" ));