diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-24 07:30:05 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-24 07:30:05 +0100 |
| commit | 73be9f9ab67842cfbec36ee99e8d2301434c84ca (patch) | |
| tree | 921d42fb4c35c64a8853f253633dcfaba33d7405 /src/type42 | |
| parent | a7a4207d1087a33521f9d76a0a2271141ebd73c8 (diff) | |
| download | freetype2-73be9f9ab67842cfbec36ee99e8d2301434c84ca.tar.gz | |
[type1, type42] Another fix for Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Add another boundary testing.
Diffstat (limited to 'src/type42')
| -rw-r--r-- | src/type42/t42parse.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index daf304d8a..d45c0699a 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -849,6 +849,12 @@ break; T1_Skip_PS_Token( parser ); + if ( parser->root.cursor >= limit ) + { + FT_ERROR(( "t42_parse_charstrings: out of bounds\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( parser->root.error ) return; |