diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-24 07:30:05 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-24 07:30:05 +0100 |
| commit | 73be9f9ab67842cfbec36ee99e8d2301434c84ca (patch) | |
| tree | 921d42fb4c35c64a8853f253633dcfaba33d7405 | |
| parent | a7a4207d1087a33521f9d76a0a2271141ebd73c8 (diff) | |
| download | freetype2-73be9f9ab67842cfbec36ee99e8d2301434c84ca.tar.gz | |
[type1, type42] Another fix for Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Add another boundary testing.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/type1/t1load.c | 5 | ||||
| -rw-r--r-- | src/type42/t42parse.c | 6 |
3 files changed, 18 insertions, 0 deletions
@@ -1,5 +1,12 @@ 2014-11-24 Werner Lemberg <wl@gnu.org> + [type1, type42] Another fix for Savannah bug #43655. + + * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c + (t42_parse_charstrings): Add another boundary testing. + +2014-11-24 Werner Lemberg <wl@gnu.org> + [docmaker] Formatting, copyright, improved documentation. * src/tools/docmaker/*: No code changes besides trivial diff --git a/src/type1/t1load.c b/src/type1/t1load.c index caa75bd..24b14a8 100644 --- a/src/type1/t1load.c +++ b/src/type1/t1load.c @@ -1596,6 +1596,11 @@ } T1_Skip_PS_Token( parser ); + if ( parser->root.cursor >= limit ) + { + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( parser->root.error ) return; diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index daf304d..d45c069 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -849,6 +849,12 @@ break; T1_Skip_PS_Token( parser ); + if ( parser->root.cursor >= limit ) + { + FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( parser->root.error ) return; |
