From cd4a5a26e591d01494567df9dec7f72d59551f6e Mon Sep 17 00:00:00 2001 From: suzuki toshiya Date: Thu, 27 Nov 2014 00:20:48 +0900 Subject: [PATCH] * src/base/ftobj.c (Mac_Read_POST_Resource): Additional overflow check in the summation of POST fragment lengths, suggested by Mateusz Jurczyk . --- ChangeLog | 6 ++++++ src/base/ftobjs.c | 7 ++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 08f1659db..d040ac74b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-11-26 suzuki toshiya + + * src/base/ftobj.c (Mac_Read_POST_Resource): Additional + overflow check in the summation of POST fragment lengths, + suggested by Mateusz Jurczyk . + 2014-11-26 suzuki toshiya * src/base/ftobjs.c (Mac_Read_POST_Resource): Insert comments diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index 4321126e4..b28216a8b 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -1586,8 +1586,10 @@ */ FT_TRACE4(( " POST fragment #%d: length=0x%08x\n", i, temp)); - if ( 0x7FFFFFFFUL < temp ) + if ( 0x7FFFFFFFUL < temp || pfb_len + temp + 6 < pfb_len ) { + FT_TRACE2(( " too long fragment length makes" + " pfb_len confused: temp=0x%08x\n", temp )); error = FT_THROW( Invalid_Offset ); goto Exit; } @@ -1600,8 +1602,7 @@ resource_cnt, pfb_len + 2)); if ( pfb_len + 2 < 6 ) { FT_TRACE2(( " too long fragment length makes" - " pfb_len confused: 0x%08x\n", - pfb_len )); + " pfb_len confused: pfb_len=0x%08x\n", pfb_len )); error = FT_THROW( Array_Too_Large ); goto Exit; }