diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-04-19 14:45:19 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-04-19 14:45:19 +0200 |
| commit | 1655e00fced6d16187fe2b3494d562795b2addd7 (patch) | |
| tree | f1b6d16f86f6b20915fe300f7e1e071e90d82f04 | |
| parent | 2a1597826a84275660e7410368200b37f85ffdaf (diff) | |
| download | freetype2-1655e00fced6d16187fe2b3494d562795b2addd7.tar.gz | |
Fix handling of invalid format 2 cmaps.
The problem was introduced after the last release.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7828
* src/sfnt/ttcmap.c (tt_cmap2_char_next): Avoid endless loop.
| -rw-r--r-- | ChangeLog | 12 | ||||
| -rw-r--r-- | src/sfnt/ttcmap.c | 7 |
2 files changed, 19 insertions, 0 deletions
@@ -1,3 +1,15 @@ +2018-03-13 Werner Lemberg <wl@gnu.org> + + Fix handling of invalid format 2 cmaps. + + The problem was introduced after the last release. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7828 + + * src/sfnt/ttcmap.c (tt_cmap2_char_next): Avoid endless loop. + 2018-04-17 Werner Lemberg <wl@gnu.org> [truetype] Integer overflow issues. diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c index dcde8693e..71a3c1e34 100644 --- a/src/sfnt/ttcmap.c +++ b/src/sfnt/ttcmap.c @@ -518,6 +518,13 @@ FT_UInt pos, idx; + if ( char_lo > start + count ) + { + /* this happens only for a malformed cmap */ + charcode = 0x100; + continue; + } + if ( offset == 0 ) { if ( charcode == 0x100 ) |