summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-27 00:20:48 +0900
committersuzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>2014-11-27 00:41:17 +0900
commitcd4a5a26e591d01494567df9dec7f72d59551f6e (patch)
tree8e42a62dddffd712b53cef3891f6f397c4ee2017
parent1720e81e3ecc7c266e54fe40175cc39c47117bf5 (diff)
downloadfreetype2-cd4a5a26e591d01494567df9dec7f72d59551f6e.tar.gz
* src/base/ftobj.c (Mac_Read_POST_Resource): Additional
overflow check in the summation of POST fragment lengths, suggested by Mateusz Jurczyk <mjurczyk@google.com>.
-rw-r--r--ChangeLog6
-rw-r--r--src/base/ftobjs.c7
2 files changed, 10 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 08f1659..d040ac7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+ * src/base/ftobj.c (Mac_Read_POST_Resource): Additional
+ overflow check in the summation of POST fragment lengths,
+ suggested by Mateusz Jurczyk <mjurczyk@google.com>.
+
+2014-11-26 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
* src/base/ftobjs.c (Mac_Read_POST_Resource): Insert comments
and fold too long tracing messages.
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 4321126..b28216a 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1586,8 +1586,10 @@
*/
FT_TRACE4(( " POST fragment #%d: length=0x%08x\n",
i, temp));
- if ( 0x7FFFFFFFUL < temp )
+ if ( 0x7FFFFFFFUL < temp || pfb_len + temp + 6 < pfb_len )
{
+ FT_TRACE2(( " too long fragment length makes"
+ " pfb_len confused: temp=0x%08x\n", temp ));
error = FT_THROW( Invalid_Offset );
goto Exit;
}
@@ -1600,8 +1602,7 @@
resource_cnt, pfb_len + 2));
if ( pfb_len + 2 < 6 ) {
FT_TRACE2(( " too long fragment length makes"
- " pfb_len confused: 0x%08x\n",
- pfb_len ));
+ " pfb_len confused: pfb_len=0x%08x\n", pfb_len ));
error = FT_THROW( Array_Too_Large );
goto Exit;
}