diff options
| author | Werner Lemberg <wl@gnu.org> | 2015-09-13 08:41:43 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2015-09-13 08:41:43 +0200 |
| commit | e3058617f384cb6709f3878f753fa17aca9e3a30 (patch) | |
| tree | 65d80a6001177c64287da8c0eb32d69debf10d9c /src/type1/t1parse.c | |
| parent | e40e8b33a1e925c7f9db57bedac4014f57481232 (diff) | |
| download | freetype2-e3058617f384cb6709f3878f753fa17aca9e3a30.tar.gz | |
[type1] Fix potential buffer overflow (#45923).
* src/type1/t1parse.c (T1_Get_Private_Dict): Assure `cur' doesn't
point to end of file buffer.
Diffstat (limited to 'src/type1/t1parse.c')
| -rw-r--r-- | src/type1/t1parse.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/type1/t1parse.c b/src/type1/t1parse.c index c73b2b2..d8d4df2 100644 --- a/src/type1/t1parse.c +++ b/src/type1/t1parse.c @@ -389,6 +389,15 @@ cur = limit; limit = parser->base_dict + parser->base_len; + + if ( cur >= limit ) + { + FT_ERROR(( "T1_Get_Private_Dict:" + " premature end in private dictionary\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Exit; + } + goto Again; /* now determine where to write the _encrypted_ binary private */ |
