[freetype2] master 581c7e2: [type1, type42] Check encoding array size (#45961).

[Werner LEMBERG]

branch: master
commit 581c7e2a510ed09b1401af8d9b7ed5eb329a954b
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [type1, type42] Check encoding array size (#45961).
    
    * src/type1/t1load.c (parse_encoding), src/type42/t42parse.c
    (t42_parse_encoding): Do it.
---
 ChangeLog             |    7 +++++++
 src/type1/t1load.c    |    9 +++++++++
 src/type42/t42parse.c |    9 +++++++++
 3 files changed, 25 insertions(+), 0 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index cd4fe58..a69a1a4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-09-15  Werner Lemberg  <address@hidden>
+
+       [type1, type42] Check encoding array size (#45961).
+
+       * src/type1/t1load.c (parse_encoding), src/type42/t42parse.c
+       (t42_parse_encoding): Do it.
+
 2015-09-14  Alexei Podtelezhnikov  <address@hidden>
 
        * src/base/ftcalc.c (FT_MulFix) [FT_LONG64]: Improve.
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 630f057..4d065f8 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1192,6 +1192,15 @@
       else
         count = (FT_Int)T1_ToInt( parser );
 
+      /* only composite fonts (which we don't support) */
+      /* can have larger values                        */
+      if ( count > 256 )
+      {
+        FT_ERROR(( "parse_encoding: invalid encoding array size\n" ));
+        parser->root.error = FT_THROW( Invalid_File_Format );
+        return;
+      }
+
       T1_Skip_Spaces( parser );
       if ( parser->root.cursor >= limit )
         return;
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index f7d5eb6..ae062da 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -332,6 +332,15 @@
       else
         count = (FT_Int)T1_ToInt( parser );
 
+      /* only composite fonts (which we don't support) */
+      /* can have larger values                        */
+      if ( count > 256 )
+      {
+        FT_ERROR(( "t42_parse_encoding: invalid encoding array size\n" ));
+        parser->root.error = FT_THROW( Invalid_File_Format );
+        return;
+      }
+
       T1_Skip_Spaces( parser );
       if ( parser->root.cursor >= limit )
         return;