[freetype2] master 2550fc7: [cff] Fix heap buffer overflow in old engine.

[Werner LEMBERG]

branch: master
commit 2550fc75a56f18aff2a6543a1ad07724b5f97767
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [cff] Fix heap buffer overflow in old engine.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
    
    * src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
    <cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
    non-zero.
---
 ChangeLog             | 12 ++++++++++++
 src/psaux/cffdecode.c |  3 +++
 2 files changed, 15 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index e2dd621..4e30cdc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2018-08-14  Werner Lemberg  <address@hidden>
+
+       [cff] Fix heap buffer overflow in old engine.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
+
+       * src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
+       <cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
+       non-zero.
+
 2018-08-16  Young Xiao  <address@hidden>
 
        * builds/mac/ftmac.c (parse_fond): Fix buffer overrun.
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 5732beb..3f4cfd4 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -1935,6 +1935,7 @@
         case cff_op_blend:
           /* this operator was removed from the Type2 specification */
           /* in version 16-March-2000                               */
+          if ( num_designs )
           {
             FT_Int  num_results = (FT_Int)( args[0] >> 16 );
 
@@ -1953,6 +1954,8 @@
             args     -= num_results * ( num_designs - 1 );
             num_args -= num_results * ( num_designs - 1 );
           }
+          else
+            goto Syntax_Error;
           break;
 
         case cff_op_dotsection: