summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-12 21:26:44 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-12 21:26:44 +0100
commit677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891 (patch)
tree6ce9f9c4e422f7b82924714a6f8b7f27a41d7f4c
parentf46add13895337ece929b18bb8f036431b3fb538 (diff)
downloadfreetype2-677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891.tar.gz
[sfnt] Fix Savannah bug #43590.
* src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir): Protect against addition overflow.
-rw-r--r--ChangeLog7
-rw-r--r--src/sfnt/ttload.c12
2 files changed, 16 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 417af86..b42b929 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-12 Werner Lemberg <wl@gnu.org>
+ [sfnt] Fix Savannah bug #43590.
+
+ * src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir):
+ Protect against addition overflow.
+
+2014-11-12 Werner Lemberg <wl@gnu.org>
+
[sfnt] Fix Savannah bug #43589.
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
diff --git a/src/sfnt/ttload.c b/src/sfnt/ttload.c
index 0a3cd29..8338150 100644
--- a/src/sfnt/ttload.c
+++ b/src/sfnt/ttload.c
@@ -5,7 +5,7 @@
/* Load the basic TrueType tables, i.e., tables that can be either in */
/* TTF or OTF fonts (body). */
/* */
-/* Copyright 1996-2010, 2012, 2013 by */
+/* Copyright 1996-2010, 2012-2014 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -207,7 +207,10 @@
}
/* we ignore invalid tables */
- if ( table.Offset + table.Length > stream->size )
+
+ /* table.Offset + table.Length > stream->size ? */
+ if ( table.Length > stream->size ||
+ table.Offset > stream->size - table.Length )
{
FT_TRACE2(( "check_table_dir: table entry %d invalid\n", nn ));
continue;
@@ -395,7 +398,10 @@
entry->Length = FT_GET_ULONG();
/* ignore invalid tables */
- if ( entry->Offset + entry->Length > stream->size )
+
+ /* entry->Offset + entry->Length > stream->size ? */
+ if ( entry->Length > stream->size ||
+ entry->Offset > stream->size - entry->Length )
continue;
else
{