diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-24 10:22:08 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-24 10:22:08 +0100 |
| commit | eca0f067068020870a429fe91f6329e499390d55 (patch) | |
| tree | d08d8a5e96179b7b68f2df50327c489a06e39c68 | |
| parent | 96341dc3785acd54d682ca51656dbcb91bd1066c (diff) | |
| download | freetype2-eca0f067068020870a429fe91f6329e499390d55.tar.gz | |
[truetype] Fix Savannah bug #43679.
* src/truetype/ttpload.c (tt_face_load_hdmx): Check minimum size of
`record_size'.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/truetype/ttpload.c | 12 |
2 files changed, 14 insertions, 5 deletions
@@ -1,3 +1,10 @@ +2014-11-24 Werner Lemberg <wl@gnu.org> + + [truetype] Fix Savannah bug #43679. + + * src/truetype/ttpload.c (tt_face_load_hdmx): Check minimum size of + `record_size'. + 2014-11-24 Jarkko Pöyry <jarkko.poyry@gmail.com> [cff, pfr, psaux, winfonts] Fix Savannah bug #43676. diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index 9723a51..9991925 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -508,9 +508,9 @@ record_size = FT_NEXT_ULONG( p ); /* The maximum number of bytes in an hdmx device record is the */ - /* maximum number of glyphs + 2; this is 0xFFFF + 2; this is */ - /* the reason why `record_size' is a long (which we read as */ - /* unsigned long for convenience). In practice, two bytes */ + /* maximum number of glyphs + 2; this is 0xFFFF + 2, thus */ + /* explaining why `record_size' is a long (which we read as */ + /* unsigned long for convenience). In practice, two bytes are */ /* sufficient to hold the size value. */ /* */ /* There are at least two fonts, HANNOM-A and HANNOM-B version */ @@ -522,8 +522,10 @@ record_size &= 0xFFFFU; /* The limit for `num_records' is a heuristic value. */ - - if ( version != 0 || num_records > 255 || record_size > 0x10001L ) + if ( version != 0 || + num_records > 255 || + record_size > 0x10001L || + record_size < 4 ) { error = FT_THROW( Invalid_File_Format ); goto Fail; |
