diff --git a/ChangeLog b/ChangeLog index a8beb7181..33f4dc778 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2009-07-31 suzuki toshiya + + type1: Check invalid string longer than PostScript limit. + + * src/type1/t1afm.c (t1_get_index): Check invalid string + which exceeds the limit of PostScript string/name objects. + 2009-07-31 suzuki toshiya gzip: Use FT2 zcalloc() & zfree() in ftgzip.c by default. diff --git a/src/type1/t1afm.c b/src/type1/t1afm.c index 5aea58820..586bfd6c6 100644 --- a/src/type1/t1afm.c +++ b/src/type1/t1afm.c @@ -57,6 +57,10 @@ FT_Int n; + /* PS string/name length must be < 16-bit */ + if ( ( len - 0xFFFFU ) > 0 ) + return 0; + for ( n = 0; n < type1->num_glyphs; n++ ) { char* gname = (char*)type1->glyph_names[n];