summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-24 07:30:05 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-24 07:30:05 +0100
commit73be9f9ab67842cfbec36ee99e8d2301434c84ca (patch)
tree921d42fb4c35c64a8853f253633dcfaba33d7405
parenta7a4207d1087a33521f9d76a0a2271141ebd73c8 (diff)
downloadfreetype2-73be9f9ab67842cfbec36ee99e8d2301434c84ca.tar.gz
[type1, type42] Another fix for Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c (t42_parse_charstrings): Add another boundary testing.
-rw-r--r--ChangeLog7
-rw-r--r--src/type1/t1load.c5
-rw-r--r--src/type42/t42parse.c6
3 files changed, 18 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 9cf9416..c19dbe8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-24 Werner Lemberg <wl@gnu.org>
+ [type1, type42] Another fix for Savannah bug #43655.
+
+ * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
+ (t42_parse_charstrings): Add another boundary testing.
+
+2014-11-24 Werner Lemberg <wl@gnu.org>
+
[docmaker] Formatting, copyright, improved documentation.
* src/tools/docmaker/*: No code changes besides trivial
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index caa75bd..24b14a8 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1596,6 +1596,11 @@
}
T1_Skip_PS_Token( parser );
+ if ( parser->root.cursor >= limit )
+ {
+ error = FT_THROW( Invalid_File_Format );
+ goto Fail;
+ }
if ( parser->root.error )
return;
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index daf304d..d45c069 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -849,6 +849,12 @@
break;
T1_Skip_PS_Token( parser );
+ if ( parser->root.cursor >= limit )
+ {
+ FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Fail;
+ }
if ( parser->root.error )
return;