diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-12-11 14:07:29 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-12-11 14:07:29 +0100 |
| commit | 812ed3418969a013fce68c3884f7f8fc23c6b4bf (patch) | |
| tree | 5917baf256d4b0c87c169e46742641b013a8393a /src/type42 | |
| parent | c9ca6ffc9442b4b127f948e2d993454aa7791e59 (diff) | |
| download | freetype2-812ed3418969a013fce68c3884f7f8fc23c6b4bf.tar.gz | |
* src/type42/t42parse.c (t42_parse_sfnts): Reject invalid TTF size.
Diffstat (limited to 'src/type42')
| -rw-r--r-- | src/type42/t42parse.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index bdecba914..50708537d 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -667,6 +667,13 @@ status = BEFORE_TABLE_DIR; face->ttf_size = 12 + 16 * num_tables; + if ( (FT_ULong)( limit - parser->root.cursor ) < face->ttf_size ) + { + FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } + if ( FT_REALLOC( face->ttf_data, 12, face->ttf_size ) ) goto Fail; } |