summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSuzuki, Toshiya (鈴木俊哉) <mpsuzuki@hiroshima-u.ac.jp>2010-08-04 14:43:29 +0200
committerWerner Lemberg <wl@gnu.org>2010-08-04 14:43:29 +0200
commit11d65e8a1f1f14e56148fd991965424d9bd1cdbc (patch)
tree65fb4c705b4241eee8c97958da2afa858c828773
parentfe3433c7368cb9b237fc35c247254d6e8cc12bb5 (diff)
downloadfreetype2-11d65e8a1f1f14e56148fd991965424d9bd1cdbc.tar.gz
[cff] Improve stack overflow test.
* src/cff/cffgload.c (cff_decoder_parse_charstrings): Check stack after execution of operations too.
-rw-r--r--ChangeLog7
-rw-r--r--src/cff/cffgload.c5
2 files changed, 11 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index 54c49b0..07cb466 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2010-08-04 Suzuki, Toshiya (鈴木俊哉) <mpsuzuki@hiroshima-u.ac.jp>
+
+ [cff] Improve stack overflow test.
+
+ * src/cff/cffgload.c (cff_decoder_parse_charstrings): Check stack
+ after execution of operations too.
+
2010-07-18 Werner Lemberg <wl@gnu.org>
Add reference counters and to FT_Library and FT_Face objects.
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 347041c..887c879 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -2455,7 +2455,10 @@
return CFF_Err_Unimplemented_Feature;
}
- decoder->top = args;
+ decoder->top = args;
+
+ if ( decoder->top - stack >= CFF_MAX_OPERANDS )
+ goto Stack_Overflow;
} /* general operator processing */