diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-08-14 10:01:00 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-08-14 10:01:00 +0200 |
| commit | 44db1addd80981b1a9cbea6b8608c99592a065ea (patch) | |
| tree | 41d849954c7118c608eff2840d75521fc32c7820 /src/psaux/cffdecode.c | |
| parent | 1937b557341187eda5434a8a64da9880472c4cd4 (diff) | |
| download | freetype2-44db1addd80981b1a9cbea6b8608c99592a065ea.tar.gz | |
[cff] Fix another segv in old engine.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9872
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
[CFF_CONFIG_OPTION_OLD_ENGINE]: Disallow invalid T1 opcodes in
dictionaries.
Diffstat (limited to 'src/psaux/cffdecode.c')
| -rw-r--r-- | src/psaux/cffdecode.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index 3f4ea15cb..2c2aa6a84 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -860,6 +860,15 @@ case cff_op_flex1: case cff_op_callsubr: case cff_op_callgsubr: + /* depracated opcodes */ + case cff_op_dotsection: + /* invalid Type 1 opcodes */ + case cff_op_hsbw: + case cff_op_closepath: + case cff_op_callothersubr: + case cff_op_seac: + case cff_op_sbw: + case cff_op_setcurrentpoint: goto MM_Error; default: |