diff options
author | Werner Lemberg <wl@gnu.org> | 2018-04-26 09:04:39 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2018-04-26 09:04:39 +0200 |
commit | ac97a29653e2a551064705891bc578c53ecf056d (patch) | |
tree | 20b2c3e010ce2d062c284c09ea543fd9464b9bbe | |
parent | 2157d8fa6f7e12063ca166476ed2223d24234db7 (diff) | |
download | freetype2-ac97a29653e2a551064705891bc578c53ecf056d.tar.gz |
Another fix for handling invalid format 2 cmaps.
Sigh.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8003
* src/sfnt/ttcmap.c (tt_cmap2_char_next): Adjust condition to avoid
an endless loop.
-rw-r--r-- | ChangeLog | 13 | ||||
-rw-r--r-- | src/sfnt/ttcmap.c | 2 |
2 files changed, 14 insertions, 1 deletions
@@ -1,3 +1,16 @@ +2018-04-26 Werner Lemberg <wl@gnu.org> + + Another fix for handling invalid format 2 cmaps. + + Sigh. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8003 + + * src/sfnt/ttcmap.c (tt_cmap2_char_next): Adjust condition to avoid + an endless loop. + 2018-04-24 Ben Wagner <bungeman@google.com> [base] Avoid undefined behaviour in lcd filtering code (#53727). diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c index 07075cbc0..996e66485 100644 --- a/src/sfnt/ttcmap.c +++ b/src/sfnt/ttcmap.c @@ -518,7 +518,7 @@ FT_UInt pos, idx; - if ( char_lo > start + count && charcode <= 0xFF ) + if ( char_lo >= start + count && charcode <= 0xFF ) { /* this happens only for a malformed cmap */ charcode = 0x100; |