rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Fix sanity check for `gvar' table (#50184). 

* src/truetype/ttgxvar.c (ft_var_load_gvar): There might be missing
variation data for some glyphs.
This commit is contained in:
Werner Lemberg 2017-01-31 08:32:07 +01:00
parent 31f8055390
commit e80e4d811a
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2017-01-31 Werner Lemberg <wl@gnu.org>
[truetype] Fix sanity check for `gvar' table (#50184).
* src/truetype/ttgxvar.c (ft_var_load_gvar): There might be missing
variation data for some glyphs.
2017-01-31 Werner Lemberg <wl@gnu.org>
[autofit] Avoid uninitialized jumps (#50191).

5
src/truetype/ttgxvar.c
View File

@ -1379,10 +1379,9 @@
goto Exit;
}
/* rough sanity check: offsets can be either 2 or 4 bytes, */
/* and a single variation needs at least 4 bytes per glyph */
/* rough sanity check: offsets can be either 2 or 4 bytes */
if ( (FT_ULong)gvar_head.glyphCount *
( ( gvar_head.flags & 1 ) ? 8 : 6 ) > table_len )
( ( gvar_head.flags & 1 ) ? 4 : 2 ) > table_len )
{
FT_TRACE1(( "ft_var_load_gvar: invalid number of glyphs\n" ));
error = FT_THROW( Invalid_Table );