[freetype2] master 7f73339: * src/base/ftrfork.c (FT_Raccess_Get_DataOffsets): Check `count'.

[Werner LEMBERG]

branch: master
commit 7f7333990ce65b0251535fe181ef1fce30219bb1
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/base/ftrfork.c (FT_Raccess_Get_DataOffsets): Check `count'.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=308
---
 ChangeLog          |    8 ++++++++
 src/base/ftrfork.c |    4 +++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index d5697da..66603c0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-12-22  Werner Lemberg  <address@hidden>
 
+       * src/base/ftrfork.c (FT_Raccess_Get_DataOffsets): Check `count'.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=308
+
+2016-12-22  Werner Lemberg  <address@hidden>
+
        [cff] Protect against invalid `vsindex' and `blend' values.
 
        Reported as
diff --git a/src/base/ftrfork.c b/src/base/ftrfork.c
index b8b97a8..e656cd7 100644
--- a/src/base/ftrfork.c
+++ b/src/base/ftrfork.c
@@ -248,7 +248,9 @@
         *count = subcnt + 1;
         rpos  += map_offset;
 
-        if ( *count > 2727 )
+        /* a zero count might be valid in the resource specification, */
+        /* however, it is completely useless to us                    */
+        if ( *count < 1 || *count > 2727 )
           return FT_THROW( Invalid_Table );
 
         error = FT_Stream_Seek( stream, (FT_ULong)rpos );