diff options
| author | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2014-11-26 16:11:38 +0900 |
|---|---|---|
| committer | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2014-11-26 17:56:30 +0900 |
| commit | 18a8f0d9943369449bc4de92d411c78fb08d616c (patch) | |
| tree | f2695f40b36b589141307b6f6cf5edfc6e331f93 | |
| parent | 453316792fee912cfced48e9e270e9eb19892e64 (diff) | |
| download | freetype2-18a8f0d9943369449bc4de92d411c78fb08d616c.tar.gz | |
Fix Savannah bug #43540.
* src/base/ftmac.c (parse_fond): Prevent a buffer overrun
caused by a font including too many (> 63) strings to store
names[] table.
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | src/base/ftmac.c | 5 |
2 files changed, 11 insertions, 2 deletions
@@ -1,5 +1,13 @@ 2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> + Fix Savannah bug #43540. + + * src/base/ftmac.c (parse_fond): Prevent a buffer overrun + caused by a font including too many (> 63) strings to store + names[] table. + +2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> + * src/base/ftobjs.c (Mac_Read_POST_Resource): Use unsigned long variables to read the lengths in POST fragments. Suggested by Mateusz Jurczyk <mjurczyk@google.com>. diff --git a/src/base/ftmac.c b/src/base/ftmac.c index 9b49da8..184a2e1 100644 --- a/src/base/ftmac.c +++ b/src/base/ftmac.c @@ -440,9 +440,10 @@ style = (StyleTable*)p; p += sizeof ( StyleTable ); string_count = EndianS16_BtoN( *(short*)(p) ); + string_count = FT_MIN( 64, string_count ); p += sizeof ( short ); - for ( i = 0; i < string_count && i < 64; i++ ) + for ( i = 0; i < string_count; i++ ) { names[i] = p; p += names[i][0]; @@ -459,7 +460,7 @@ ps_name[ps_name_len] = 0; } if ( style->indexes[face_index] > 1 && - style->indexes[face_index] <= FT_MIN( string_count, 64 ) ) + style->indexes[face_index] <= string_count ) { unsigned char* suffixes = names[style->indexes[face_index] - 1]; |
