[Git][freetype/freetype][master] [sfnt] Fix bounds check in SVG.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 335224be
  by Ben Wagner at 2022-03-03T16:42:54-05:00

  [sfnt] Fix bounds check in SVG.
  
  The `SVG_DOCUMENT_LIST_MINIMUM_SIZE` macro is non trivial and not
  protected by parentheses. As a result, the _expression_
  `table_size - SVG_DOCUMENT_LIST_MINIMUM_SIZE` expands to
  `table_size - 2U + SVG_DOCUMENT_RECORD_SIZE` instead of the expected
  `table_size - (2U + SVG_DOCUMENT_RECORD_SIZE)`. This causes an incorrect
  bounds check which may lead to reading past the end of the `SVG ` table.
  
  * src/sfnt/ttsvg.c (tt_face_load_svg): wrap macro definitions in
  parentheses.
  
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45179
  

1 changed file:

• src/sfnt/ttsvg.c

Changes:

src/sfnt/ttsvg.c

---

...	...	@@ -39,11 +39,11 @@
39	39
40	40
41	41	/* NOTE: These table sizes are given by the specification. */
42		-#define SVG_TABLE_HEADER_SIZE 10U
43		-#define SVG_DOCUMENT_RECORD_SIZE 12U
44		-#define SVG_DOCUMENT_LIST_MINIMUM_SIZE 2U + SVG_DOCUMENT_RECORD_SIZE
45		-#define SVG_MINIMUM_SIZE SVG_TABLE_HEADER_SIZE + \
46		- SVG_DOCUMENT_LIST_MINIMUM_SIZE
	42	+#define SVG_TABLE_HEADER_SIZE (10U)
	43	+#define SVG_DOCUMENT_RECORD_SIZE (12U)
	44	+#define SVG_DOCUMENT_LIST_MINIMUM_SIZE (2U + SVG_DOCUMENT_RECORD_SIZE)
	45	+#define SVG_MINIMUM_SIZE (SVG_TABLE_HEADER_SIZE + \
	46	+ SVG_DOCUMENT_LIST_MINIMUM_SIZE)
47	47
48	48
49	49	typedef struct Svg_

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.