diff options
author | Werner Lemberg <wl@gnu.org> | 2018-04-15 21:55:04 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2018-04-15 21:55:04 +0200 |
commit | 235b1e2fe6ca325f449c5a73c75432d62d73f524 (patch) | |
tree | 7fb6c479a7f151c49cac3b576b8b6f9de3cd42da | |
parent | 827ca3bcf25b9e4dc2edf31381c0774e1d227285 (diff) | |
download | freetype2-235b1e2fe6ca325f449c5a73c75432d62d73f524.tar.gz |
[truetype]: Limit `SLOOP' bytecode argument to 16 bits.
This fixes
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7707
* src/truetype/ttinterp.c (Ins_SLOOP): Do it.
-rw-r--r-- | ChangeLog | 10 | ||||
-rw-r--r-- | src/truetype/ttinterp.c | 5 |
2 files changed, 14 insertions, 1 deletions
@@ -1,3 +1,13 @@ +2018-04-15 Werner Lemberg <wl@gnu.org> + + [truetype]: Limit `SLOOP' bytecode argument to 16 bits. + + This fixes + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7707 + + * src/truetype/ttinterp.c (Ins_SLOOP): Do it. + 2018-04-14 Werner Lemberg <wl@gnu.org> [truetype] Integer overflow issues. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index d9865d4af..c66c69929 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -3289,7 +3289,10 @@ if ( args[0] < 0 ) exc->error = FT_THROW( Bad_Argument ); else - exc->GS.loop = args[0]; + { + /* we heuristically limit the number of loops to 16 bits */ + exc->GS.loop = args[0] > 0xFFFFL ? 0xFFFFL : args[0]; + } } |