summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-26 16:11:38 +0900
committersuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-26 17:56:30 +0900
commit18a8f0d9943369449bc4de92d411c78fb08d616c (patch)
treef2695f40b36b589141307b6f6cf5edfc6e331f93
parent453316792fee912cfced48e9e270e9eb19892e64 (diff)
downloadfreetype2-18a8f0d9943369449bc4de92d411c78fb08d616c.tar.gz
Fix Savannah bug #43540.
* src/base/ftmac.c (parse_fond): Prevent a buffer overrun caused by a font including too many (> 63) strings to store names[] table.
-rw-r--r--ChangeLog8
-rw-r--r--src/base/ftmac.c5
2 files changed, 11 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index f0e292c..deac0e7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+ Fix Savannah bug #43540.
+
+ * src/base/ftmac.c (parse_fond): Prevent a buffer overrun
+ caused by a font including too many (> 63) strings to store
+ names[] table.
+
+2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
* src/base/ftobjs.c (Mac_Read_POST_Resource): Use unsigned long
variables to read the lengths in POST fragments. Suggested by
Mateusz Jurczyk <mjurczyk@google.com>.
diff --git a/src/base/ftmac.c b/src/base/ftmac.c
index 9b49da8..184a2e1 100644
--- a/src/base/ftmac.c
+++ b/src/base/ftmac.c
@@ -440,9 +440,10 @@
style = (StyleTable*)p;
p += sizeof ( StyleTable );
string_count = EndianS16_BtoN( *(short*)(p) );
+ string_count = FT_MIN( 64, string_count );
p += sizeof ( short );
- for ( i = 0; i < string_count && i < 64; i++ )
+ for ( i = 0; i < string_count; i++ )
{
names[i] = p;
p += names[i][0];
@@ -459,7 +460,7 @@
ps_name[ps_name_len] = 0;
}
if ( style->indexes[face_index] > 1 &&
- style->indexes[face_index] <= FT_MIN( string_count, 64 ) )
+ style->indexes[face_index] <= string_count )
{
unsigned char* suffixes = names[style->indexes[face_index] - 1];