diff options
author | Werner Lemberg <wl@gnu.org> | 2018-09-12 07:27:30 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2018-09-12 07:27:30 +0200 |
commit | 53c5e4bd87ff8035d91022204bb5f3a051e78a99 (patch) | |
tree | 5b926a43c64b6646e54555577854b32dcb85f82d /src/truetype/ttgxvar.c | |
parent | 7b855ed9cf8c48841e72369ea3ebcbf8486e5e06 (diff) | |
download | freetype2-53c5e4bd87ff8035d91022204bb5f3a051e78a99.tar.gz |
* src/truetype/ttgxvar.c (ft_var_load_gvar): Check `glyphoffsets'.
Diffstat (limited to 'src/truetype/ttgxvar.c')
-rw-r--r-- | src/truetype/ttgxvar.c | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index fef0c8a46..3a2c5409d 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -1531,24 +1531,51 @@ if ( gvar_head.flags & 1 ) { + FT_ULong limit = gvar_start + table_len; + + /* long offsets (one more offset than glyphs, to mark size of last) */ if ( FT_FRAME_ENTER( ( blend->gv_glyphcnt + 1 ) * 4L ) ) goto Exit; for ( i = 0; i <= blend->gv_glyphcnt; i++ ) + { blend->glyphoffsets[i] = offsetToData + FT_GET_ULONG(); + /* use `>', not `>=' */ + if ( blend->glyphoffsets[i] > limit ) + { + FT_TRACE2(( "ft_var_load_gvar:" + " invalid glyph variation data offset for index %d\n", + i )); + error = FT_THROW( Invalid_Table ); + goto Exit; + } + } FT_FRAME_EXIT(); } else { + FT_ULong limit = gvar_start + table_len; + + /* short offsets (one more offset than glyphs, to mark size of last) */ if ( FT_FRAME_ENTER( ( blend->gv_glyphcnt + 1 ) * 2L ) ) goto Exit; for ( i = 0; i <= blend->gv_glyphcnt; i++ ) + { blend->glyphoffsets[i] = offsetToData + FT_GET_USHORT() * 2; - /* XXX: Undocumented: `*2'! */ + /* use `>', not `>=' */ + if ( blend->glyphoffsets[i] > limit ) + { + FT_TRACE2(( "ft_var_load_gvar:" + " invalid glyph variation data offset for index %d\n", + i )); + error = FT_THROW( Invalid_Table ); + goto Exit; + } + } FT_FRAME_EXIT(); } |