summaryrefslogtreecommitdiff
path: root/src/type1/t1parse.c
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2015-09-13 08:41:43 +0200
committerWerner Lemberg <wl@gnu.org>2015-09-13 08:41:43 +0200
commite3058617f384cb6709f3878f753fa17aca9e3a30 (patch)
tree65d80a6001177c64287da8c0eb32d69debf10d9c /src/type1/t1parse.c
parente40e8b33a1e925c7f9db57bedac4014f57481232 (diff)
downloadfreetype2-e3058617f384cb6709f3878f753fa17aca9e3a30.tar.gz
[type1] Fix potential buffer overflow (#45923).
* src/type1/t1parse.c (T1_Get_Private_Dict): Assure `cur' doesn't point to end of file buffer.
Diffstat (limited to 'src/type1/t1parse.c')
-rw-r--r--src/type1/t1parse.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/type1/t1parse.c b/src/type1/t1parse.c
index c73b2b2..d8d4df2 100644
--- a/src/type1/t1parse.c
+++ b/src/type1/t1parse.c
@@ -389,6 +389,15 @@
cur = limit;
limit = parser->base_dict + parser->base_len;
+
+ if ( cur >= limit )
+ {
+ FT_ERROR(( "T1_Get_Private_Dict:"
+ " premature end in private dictionary\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
goto Again;
/* now determine where to write the _encrypted_ binary private */