diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-21 22:19:28 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-21 22:19:28 +0100 |
| commit | dd89710f0f643eb0f99a3830e0712d26c7642acd (patch) | |
| tree | b9b3dc7badbf25983a4ce8a496ac945709114ec7 | |
| parent | b1fc00d5dc0e89432c58367477b6d9d63b6b0be9 (diff) | |
| download | freetype2-dd89710f0f643eb0f99a3830e0712d26c7642acd.tar.gz | |
[type1, type42] Fix Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Fix boundary testing.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/type1/t1load.c | 2 | ||||
| -rw-r--r-- | src/type42/t42parse.c | 2 |
3 files changed, 9 insertions, 2 deletions
@@ -1,5 +1,12 @@ 2014-11-21 Werner Lemberg <wl@gnu.org> + [type1, type42] Fix Savannah bug #43655. + + * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c + (t42_parse_charstrings): Fix boundary testing. + +2014-11-21 Werner Lemberg <wl@gnu.org> + * src/pcf/pcfread.c (pcf_get_metrics): Sanitize invalid metrics. 2014-11-21 Werner Lemberg <wl@gnu.org> diff --git a/src/type1/t1load.c b/src/type1/t1load.c index fd06432..caa75bd 100644 --- a/src/type1/t1load.c +++ b/src/type1/t1load.c @@ -1604,7 +1604,7 @@ FT_PtrDist len; - if ( cur + 1 >= limit ) + if ( cur + 2 >= limit ) { error = FT_THROW( Invalid_File_Format ); goto Fail; diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index 9b66888..a60e216 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -858,7 +858,7 @@ FT_PtrDist len; - if ( cur + 1 >= limit ) + if ( cur + 2 >= limit ) { FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); error = FT_THROW( Invalid_File_Format ); |
