summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-06 23:25:05 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-06 23:25:05 +0100
commitef1eba75187adfac750f326b563fe543dd5ff4e6 (patch)
tree094fdec0a50fc5b01995d6aef3f715682a0d5a21
parent0e2f5d518c60e2978f26400d110eff178fa7e3c3 (diff)
downloadfreetype2-ef1eba75187adfac750f326b563fe543dd5ff4e6.tar.gz
Fix Savannah bug #43548.
* src/pcf/pcfread (pcf_get_encodings): Add sanity checks for row and column values.
-rw-r--r--ChangeLog7
-rw-r--r--src/pcf/pcfread.c9
2 files changed, 16 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 9b56e91..d709e41 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-06 Werner Lemberg <wl@gnu.org>
+ Fix Savannah bug #43548.
+
+ * src/pcf/pcfread (pcf_get_encodings): Add sanity checks for row and
+ column values.
+
+2014-11-06 Werner Lemberg <wl@gnu.org>
+
Fix Savannah bug #43547.
* src/pcf/pcfread.c (pcf_read_TOC): Check `size' and `offset'
diff --git a/src/pcf/pcfread.c b/src/pcf/pcfread.c
index 8db31bd..668c962 100644
--- a/src/pcf/pcfread.c
+++ b/src/pcf/pcfread.c
@@ -830,6 +830,15 @@ THE SOFTWARE.
if ( !PCF_FORMAT_MATCH( format, PCF_DEFAULT_FORMAT ) )
return FT_THROW( Invalid_File_Format );
+ /* sanity checks */
+ if ( firstCol < 0 ||
+ firstCol > lastCol ||
+ lastCol > 0xFF ||
+ firstRow < 0 ||
+ firstRow > lastRow ||
+ lastRow > 0xFF )
+ return FT_THROW( Invalid_Table );
+
FT_TRACE4(( "pdf_get_encodings:\n" ));
FT_TRACE4(( " firstCol %d, lastCol %d, firstRow %d, lastRow %d\n",