rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Fix Savannah bug #43679. 

* src/truetype/ttpload.c (tt_face_load_hdmx): Check minimum size of
`record_size'.
This commit is contained in:
Werner Lemberg 2014-11-24 10:22:08 +01:00
parent 96341dc378
commit eca0f06706
2 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2014-11-24 Werner Lemberg <wl@gnu.org>
[truetype] Fix Savannah bug #43679.
* src/truetype/ttpload.c (tt_face_load_hdmx): Check minimum size of
`record_size'.
2014-11-24 Jarkko Pöyry <jarkko.poyry@gmail.com>
[cff, pfr, psaux, winfonts] Fix Savannah bug #43676.

12
src/truetype/ttpload.c
View File

@ -508,9 +508,9 @@
record_size = FT_NEXT_ULONG( p );
/* The maximum number of bytes in an hdmx device record is the */
/* maximum number of glyphs + 2; this is 0xFFFF + 2; this is */
/* the reason why `record_size' is a long (which we read as */
/* unsigned long for convenience). In practice, two bytes */
/* maximum number of glyphs + 2; this is 0xFFFF + 2, thus */
/* explaining why `record_size' is a long (which we read as */
/* unsigned long for convenience). In practice, two bytes are */
/* sufficient to hold the size value. */
/* */
/* There are at least two fonts, HANNOM-A and HANNOM-B version */
@ -522,8 +522,10 @@
record_size &= 0xFFFFU;
/* The limit for `num_records' is a heuristic value. */
if ( version != 0 || num_records > 255 || record_size > 0x10001L )
if ( version != 0 ||
num_records > 255 ||
record_size > 0x10001L ||
record_size < 4 )
{
error = FT_THROW( Invalid_File_Format );
goto Fail;