summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-26 15:52:23 +0900
committersuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-26 17:55:55 +0900
commit35252ae9aa1dd9343e9f4884e9ddb1fee10ef415 (patch)
tree41f0f7c8ba9c7684ca572149a6bc15402e6939f9
parent240c94a185cd8dae7d03059abec8a5662c35ecd3 (diff)
downloadfreetype2-35252ae9aa1dd9343e9f4884e9ddb1fee10ef415.tar.gz
Fix Savannah bug #43539.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow by a broken POST table in resource-fork.
-rw-r--r--ChangeLog7
-rw-r--r--src/base/ftobjs.c17
2 files changed, 24 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 5ba75b6..8a246e8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+ Fix Savannah bug #43539.
+
+ * src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
+ by a broken POST table in resource-fork.
+
+2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
Fix Savannah bug #43538.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index ffbbc32..922216e 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1617,6 +1617,11 @@
goto Exit2;
if ( FT_READ_LONG( rlen ) )
goto Exit2;
+ if ( rlen < 0 )
+ {
+ error = FT_THROW( Invalid_Offset );
+ goto Exit2;
+ }
if ( FT_READ_USHORT( flags ) )
goto Exit2;
FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
@@ -1634,7 +1639,14 @@
rlen = 0;
if ( ( flags >> 8 ) == type )
+ {
+ if ( 0x7FFFFFFFL - rlen < len )
+ {
+ error = FT_THROW( Array_Too_Large );
+ goto Exit2;
+ }
len += rlen;
+ }
else
{
if ( pfb_lenpos + 3 > pfb_len + 2 )
@@ -1663,6 +1675,11 @@
}
error = FT_ERR( Cannot_Open_Resource );
+ if ( rlen > 0x7FFFFFFFL - pfb_pos )
+ {
+ error = FT_THROW( Array_Too_Large );
+ goto Exit2;
+ }
if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
goto Exit2;