diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-04-19 14:45:19 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-04-19 14:45:19 +0200 |
| commit | 1655e00fced6d16187fe2b3494d562795b2addd7 (patch) | |
| tree | f1b6d16f86f6b20915fe300f7e1e071e90d82f04 /src/sfnt/ttcmap.c | |
| parent | 2a1597826a84275660e7410368200b37f85ffdaf (diff) | |
| download | freetype2-1655e00fced6d16187fe2b3494d562795b2addd7.tar.gz | |
Fix handling of invalid format 2 cmaps.
The problem was introduced after the last release.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7828
* src/sfnt/ttcmap.c (tt_cmap2_char_next): Avoid endless loop.
Diffstat (limited to 'src/sfnt/ttcmap.c')
| -rw-r--r-- | src/sfnt/ttcmap.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c index dcde8693e..71a3c1e34 100644 --- a/src/sfnt/ttcmap.c +++ b/src/sfnt/ttcmap.c @@ -518,6 +518,13 @@ FT_UInt pos, idx; + if ( char_lo > start + count ) + { + /* this happens only for a malformed cmap */ + charcode = 0x100; + continue; + } + if ( offset == 0 ) { if ( charcode == 0x100 ) |