diff options
| author | Young Xiao <yangx92@hotmail.com> | 2018-08-16 08:25:47 -0400 |
|---|---|---|
| committer | Alexei Podtelezhnikov <apodtele@gmail.com> | 2018-08-16 08:25:47 -0400 |
| commit | c94162a2200c16e9614289cf91d6bf0e0b01a01f (patch) | |
| tree | 2053fe1c507b8d42630a3431acba98dc2677d2ac /builds | |
| parent | 33cd1eedcf4de94eee1dae5753b974f893506a9f (diff) | |
| download | freetype2-c94162a2200c16e9614289cf91d6bf0e0b01a01f.tar.gz | |
* builds/mac/ftmac.c (parse_fond): Fix buffer overrun.
Reported as bug #54515, duplicate of #43540.
Diffstat (limited to 'builds')
| -rw-r--r-- | builds/mac/ftmac.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/builds/mac/ftmac.c b/builds/mac/ftmac.c index c45546cee..c19945aca 100644 --- a/builds/mac/ftmac.c +++ b/builds/mac/ftmac.c @@ -780,9 +780,10 @@ typedef short ResourceIndex; style = (StyleTable*)p; p += sizeof ( StyleTable ); string_count = EndianS16_BtoN( *(short*)(p) ); + string_count = FT_MIN( 64, string_count ); p += sizeof ( short ); - for ( i = 0; i < string_count && i < 64; i++ ) + for ( i = 0; i < string_count; i++ ) { names[i] = p; p += names[i][0]; @@ -799,7 +800,7 @@ typedef short ResourceIndex; ps_name[ps_name_len] = 0; } if ( style->indexes[face_index] > 1 && - style->indexes[face_index] <= FT_MIN( string_count, 64 ) ) + style->indexes[face_index] <= string_count ) { unsigned char* suffixes = names[style->indexes[face_index] - 1]; |