diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-12 21:42:13 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-12 21:42:13 +0100 |
| commit | 257c270bd25e15890190a28a1456e7623bba4439 (patch) | |
| tree | e604762faf36a682806f0da43756e2e791b0d512 | |
| parent | 677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891 (diff) | |
| download | freetype2-257c270bd25e15890190a28a1456e7623bba4439.tar.gz | |
[sfnt] Fix Savannah bug #43591.
* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
and multiplication overflow.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/sfnt/ttsbit.c | 8 |
2 files changed, 12 insertions, 3 deletions
@@ -1,5 +1,12 @@ 2014-11-12 Werner Lemberg <wl@gnu.org> + [sfnt] Fix Savannah bug #43591. + + * src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition + and multiplication overflow. + +2014-11-12 Werner Lemberg <wl@gnu.org> + [sfnt] Fix Savannah bug #43590. * src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir): diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c index da6b01b..b37bd7d 100644 --- a/src/sfnt/ttsbit.c +++ b/src/sfnt/ttsbit.c @@ -394,9 +394,11 @@ p += 34; decoder->bit_depth = *p; - if ( decoder->strike_index_array > face->sbit_table_size || - decoder->strike_index_array + 8 * decoder->strike_index_count > - face->sbit_table_size ) + /* decoder->strike_index_array + */ + /* 8 * decoder->strike_index_count > face->sbit_table_size ? */ + if ( decoder->strike_index_array > face->sbit_table_size || + decoder->strike_index_count > + ( face->sbit_table_size - decoder->strike_index_array ) / 8 ) error = FT_THROW( Invalid_File_Format ); } |
