diff options
| author | Dominik Röttsches <drott@chromium.org> | 2022-08-30 15:00:37 +0300 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-09-05 12:23:31 +0200 |
| commit | 6d62076ae5d000612202aeae99c71ce27fdb2fb1 (patch) | |
| tree | f81a884b891e373d24d880d452af69801e219148 | |
| parent | 048f2e247c3ebe84fb26e52198d05e4c586764df (diff) | |
| download | freetype2-6d62076ae5d000612202aeae99c71ce27fdb2fb1.tar.gz | |
[sfnt] Pointer sanity checks before reading layer info in 'COLR' v0
* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to
read from is within the 'COLR' table.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633
| -rw-r--r-- | src/sfnt/ttcolr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c index 1277bbd53..ad0f1278a 100644 --- a/src/sfnt/ttcolr.c +++ b/src/sfnt/ttcolr.c @@ -481,7 +481,9 @@ iterator->p = colr->layers + offset; } - if ( iterator->layer >= iterator->num_layers ) + if ( iterator->layer >= iterator->num_layers || + iterator->p < colr->layers || + iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) ) return 0; *aglyph_index = FT_NEXT_USHORT( iterator->p ); |