summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-06 22:32:46 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-06 22:32:46 +0100
commit0e2f5d518c60e2978f26400d110eff178fa7e3c3 (patch)
tree49f5c3daeddb523812dc3abb8e5571948a6a8427
parentf49a100a6c4b7e30f55b0b9867ea4255c144658c (diff)
downloadfreetype2-0e2f5d518c60e2978f26400d110eff178fa7e3c3.tar.gz
Fix Savannah bug #43547.
* src/pcf/pcfread.c (pcf_read_TOC): Check `size' and `offset' values.
-rw-r--r--ChangeLog7
-rw-r--r--src/pcf/pcfread.c15
2 files changed, 22 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index fe16048..9b56e91 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-06 Werner Lemberg <wl@gnu.org>
+ Fix Savannah bug #43547.
+
+ * src/pcf/pcfread.c (pcf_read_TOC): Check `size' and `offset'
+ values.
+
+2014-11-06 Werner Lemberg <wl@gnu.org>
+
* src/pcf/pcfread.c (pcf_read_TOC): Avoid memory leak.
2014-11-03 Infinality <infinality@infinality.net>
diff --git a/src/pcf/pcfread.c b/src/pcf/pcfread.c
index f63377b..8db31bd 100644
--- a/src/pcf/pcfread.c
+++ b/src/pcf/pcfread.c
@@ -154,6 +154,21 @@ THE SOFTWARE.
break;
}
+ /* we now check whether the `size' and `offset' values are reasonable: */
+ /* `offset' + `size' must not exceed the stream size */
+ tables = face->toc.tables;
+ for ( n = 0; n < toc->count; n++ )
+ {
+ /* we need two checks to avoid overflow */
+ if ( ( tables->size > stream->size ) ||
+ ( tables->offset > stream->size - tables->size ) )
+ {
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+ tables++;
+ }
+
#ifdef FT_DEBUG_LEVEL_TRACE
{