summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-12 21:42:13 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-12 21:42:13 +0100
commit257c270bd25e15890190a28a1456e7623bba4439 (patch)
treee604762faf36a682806f0da43756e2e791b0d512
parent677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891 (diff)
downloadfreetype2-257c270bd25e15890190a28a1456e7623bba4439.tar.gz
[sfnt] Fix Savannah bug #43591.
* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition and multiplication overflow.
-rw-r--r--ChangeLog7
-rw-r--r--src/sfnt/ttsbit.c8
2 files changed, 12 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index b42b929..a6465e7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-12 Werner Lemberg <wl@gnu.org>
+ [sfnt] Fix Savannah bug #43591.
+
+ * src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
+ and multiplication overflow.
+
+2014-11-12 Werner Lemberg <wl@gnu.org>
+
[sfnt] Fix Savannah bug #43590.
* src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir):
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index da6b01b..b37bd7d 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -394,9 +394,11 @@
p += 34;
decoder->bit_depth = *p;
- if ( decoder->strike_index_array > face->sbit_table_size ||
- decoder->strike_index_array + 8 * decoder->strike_index_count >
- face->sbit_table_size )
+ /* decoder->strike_index_array + */
+ /* 8 * decoder->strike_index_count > face->sbit_table_size ? */
+ if ( decoder->strike_index_array > face->sbit_table_size ||
+ decoder->strike_index_count >
+ ( face->sbit_table_size - decoder->strike_index_array ) / 8 )
error = FT_THROW( Invalid_File_Format );
}