diff options
| author | Werner Lemberg <wl@gnu.org> | 2019-09-25 08:48:26 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2019-09-25 08:48:26 +0200 |
| commit | db4083fd7f19fd3fbd5d5a8e60d5c8e0f19778bd (patch) | |
| tree | 74c8f1c2eefe0e1738bb7f17a4deb52d788b68a3 /src/sfnt | |
| parent | 4881f75b7ca04a35da4b467b46b28ae52b176482 (diff) | |
| download | freetype2-db4083fd7f19fd3fbd5d5a8e60d5c8e0f19778bd.tar.gz | |
* src/sfnt/sfwoff2.c (woff2_open_font): Check (sum of) table sizes.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17684
Diffstat (limited to 'src/sfnt')
| -rw-r--r-- | src/sfnt/sfwoff2.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c index bb7c9815b..7d9017938 100644 --- a/src/sfnt/sfwoff2.c +++ b/src/sfnt/sfwoff2.c @@ -2161,6 +2161,13 @@ goto Exit; } + if ( woff2.uncompressed_size > sfnt_size ) + { + FT_ERROR(( "woff2_open_font: SFNT table lengths are too large.\n" )); + error = FT_THROW( Invalid_Table ); + goto Exit; + } + /* Allocate memory for uncompressed table data. */ if ( FT_ALLOC( uncompressed_buf, woff2.uncompressed_size ) || FT_FRAME_ENTER( woff2.totalCompressedSize ) ) |