rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Protect against invalid `hintmask' and `cntrmask' operators. 

* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Ensure that we don't exceed `limit' while parsing
the bit masks of the `hintmask' and `cntrmask' operators.
This commit is contained in:
Werner Lemberg 2010-06-27 12:34:19 +02:00
parent 1c70fcbc0a
commit e9f0cdb6c0
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2010-06-27 Werner Lemberg <wl@gnu.org>
[cff] Protect against invalid `hintmask' and `cntrmask' operators.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Ensure that we don't exceed `limit' while parsing
the bit masks of the `hintmask' and `cntrmask' operators.
2010-06-26 Werner Lemberg <wl@gnu.org>
Fix PFR change 2010-06-24.

10
src/cff/cffgload.c
View File

@ -1341,6 +1341,14 @@
if ( hinter )
{
/* In a valid charstring there must be at least three bytes */
/* after `hintmask' or `cntrmask' (two for a `moveto' */
/* operator and one for `endchar'). Additionally, there */
/* must be space for `num_hints' bits. */
if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
goto Syntax_Error;
if ( op == cff_op_hintmask )
hinter->hintmask( hinter->hints,
builder->current->n_points,
@ -1360,7 +1368,7 @@
FT_TRACE4(( " (maskbytes:" ));
for ( maskbyte = 0;
maskbyte < (FT_UInt)(( decoder->num_hints + 7 ) >> 3);
maskbyte < (FT_UInt)( ( decoder->num_hints + 7 ) >> 3 );
maskbyte++, ip++ )
FT_TRACE4(( " 0x%02X", *ip ));