diff options
| author | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2014-11-26 15:52:23 +0900 |
|---|---|---|
| committer | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2014-11-26 17:55:55 +0900 |
| commit | 35252ae9aa1dd9343e9f4884e9ddb1fee10ef415 (patch) | |
| tree | 41f0f7c8ba9c7684ca572149a6bc15402e6939f9 | |
| parent | 240c94a185cd8dae7d03059abec8a5662c35ecd3 (diff) | |
| download | freetype2-35252ae9aa1dd9343e9f4884e9ddb1fee10ef415.tar.gz | |
Fix Savannah bug #43539.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
by a broken POST table in resource-fork.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/base/ftobjs.c | 17 |
2 files changed, 24 insertions, 0 deletions
@@ -1,5 +1,12 @@ 2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> + Fix Savannah bug #43539. + + * src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow + by a broken POST table in resource-fork. + +2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> + Fix Savannah bug #43538. * src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index ffbbc32..922216e 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -1617,6 +1617,11 @@ goto Exit2; if ( FT_READ_LONG( rlen ) ) goto Exit2; + if ( rlen < 0 ) + { + error = FT_THROW( Invalid_Offset ); + goto Exit2; + } if ( FT_READ_USHORT( flags ) ) goto Exit2; FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n", @@ -1634,7 +1639,14 @@ rlen = 0; if ( ( flags >> 8 ) == type ) + { + if ( 0x7FFFFFFFL - rlen < len ) + { + error = FT_THROW( Array_Too_Large ); + goto Exit2; + } len += rlen; + } else { if ( pfb_lenpos + 3 > pfb_len + 2 ) @@ -1663,6 +1675,11 @@ } error = FT_ERR( Cannot_Open_Resource ); + if ( rlen > 0x7FFFFFFFL - pfb_pos ) + { + error = FT_THROW( Array_Too_Large ); + goto Exit2; + } if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len ) goto Exit2; |
