diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-12-11 13:33:14 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-12-11 13:33:14 +0100 |
| commit | b94381134efd41c6885d38e08d14106feec7284b (patch) | |
| tree | 07a9a95b063759af1dd81f0f1c667617ebb1fe16 /src/type42 | |
| parent | 9bd1e558502ebbcb8ccd1d9b765fd9d97d1da759 (diff) | |
| download | freetype2-b94381134efd41c6885d38e08d14106feec7284b.tar.gz | |
* src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.
Problem reported by Dennis Felsing <dennis@felsin9.de>.
Diffstat (limited to 'src/type42')
| -rw-r--r-- | src/type42/t42parse.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c index fd3d669f6..bdecba914 100644 --- a/src/type42/t42parse.c +++ b/src/type42/t42parse.c @@ -580,6 +580,12 @@ /* don't include delimiters */ string_size = (FT_Long)( ( parser->root.cursor - cur - 2 + 1 ) / 2 ); + if ( !string_size ) + { + FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } if ( FT_REALLOC( string_buf, old_string_size, string_size ) ) goto Fail; |