[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master bebac3c: [base] Reject invalid sfnt Mac resource (#47
From: |
Werner LEMBERG |
Subject: |
[freetype2] master bebac3c: [base] Reject invalid sfnt Mac resource (#47891). |
Date: |
Mon, 16 May 2016 18:17:05 +0000 (UTC) |
branch: master
commit bebac3cf5b5596a8d3888c0a8c0e3c9df20da98c
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[base] Reject invalid sfnt Mac resource (#47891).
* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
of `CID ' and `TYPE1' table offset and length.
---
ChangeLog | 7 +++++++
src/base/ftobjs.c | 17 ++++++++++++++++-
2 files changed, 23 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index 02539f6..77e825b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2016-05-16 Werner Lemberg <address@hidden>
+ [base] Reject invalid sfnt Mac resource (#47891).
+
+ * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
+ of `CID ' and `TYPE1' table offset and length.
+
+2016-05-16 Werner Lemberg <address@hidden>
+
[cid] Fix scanning for `StartData' and `/sfnts' (#47892).
* src/cid/cidparse.c (STARTDATA, STARTDATA_LEN, SFNTS, SFNTS_LEN):
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index af38d04..ff6ac11 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1483,6 +1483,7 @@
if ( face_index >= 0 && pstable_index == face_index )
return FT_Err_Ok;
}
+
return FT_THROW( Table_Missing );
}
@@ -1520,6 +1521,19 @@
if ( error )
goto Exit;
+ if ( offset > stream->size )
+ {
+ FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table offset\n" ));
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+ else if ( length > stream->size - offset )
+ {
+ FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table length\n" ));
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+
error = FT_Stream_Seek( stream, pos + offset );
if ( error )
goto Exit;
@@ -1528,7 +1542,8 @@
goto Exit;
error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
- if ( error ) {
+ if ( error )
+ {
FT_FREE( sfnt_ps );
goto Exit;
}
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master bebac3c: [base] Reject invalid sfnt Mac resource (#47891).,
Werner LEMBERG <=