diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-12 21:06:08 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-12 21:06:08 +0100 |
| commit | f46add13895337ece929b18bb8f036431b3fb538 (patch) | |
| tree | dbd748dda47a213149ae6cc741753e8ad43aa923 | |
| parent | 602040b1112c9f94d68e200be59ea7ac3d104565 (diff) | |
| download | freetype2-f46add13895337ece929b18bb8f036431b3fb538.tar.gz | |
[sfnt] Fix Savannah bug #43589.
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
overflow.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/sfnt/sfobjs.c | 6 |
2 files changed, 11 insertions, 2 deletions
@@ -1,5 +1,12 @@ 2014-11-12 Werner Lemberg <wl@gnu.org> + [sfnt] Fix Savannah bug #43589. + + * src/sfnt/sfobjs.c (woff_open_font): Protect against addition + overflow. + +2014-11-12 Werner Lemberg <wl@gnu.org> + [sfnt] Fix Savannah bug #43588. * src/sfnt/ttcmap.c (tt_cmap8_validate, tt_cmap10_validate, diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c index cfea9cd..70b988d 100644 --- a/src/sfnt/sfobjs.c +++ b/src/sfnt/sfobjs.c @@ -567,8 +567,10 @@ if ( table->Offset != woff_offset || - table->Offset + table->CompLength > woff.length || - sfnt_offset + table->OrigLength > woff.totalSfntSize || + table->CompLength > woff.length || + table->Offset > woff.length - table->CompLength || + table->OrigLength > woff.totalSfntSize || + sfnt_offset > woff.totalSfntSize - table->OrigLength || table->CompLength > table->OrigLength ) { error = FT_THROW( Invalid_Table ); |
