diff options
| author | Dominik Röttsches <drott@chromium.org> | 2022-10-18 14:45:43 +0300 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-10-18 19:55:25 +0200 |
| commit | 0b62c1e43dc4b0e3c50662aac757e4f7321e5466 (patch) | |
| tree | b003add3efef5a2ed10a4f917558c96b90890ff7 /subprojects | |
| parent | af46fcc15a1842e851b1f0b873154484d0d9d13c (diff) | |
| download | freetype2-0b62c1e43dc4b0e3c50662aac757e4f7321e5466.tar.gz | |
[sfnt] Additional bounds checks for `COLR` v1 table handling.
* src/sfnt/ttcolr.c (read_paint): Add `colr` argument, necessary for...
... another use of `ENSURE_READ_BYTES`.
Update callers.
(tt_face_get_paint_layers): Ensure that the 4-byte paint table
offset can be read.
This is a follow-up to !124 and issue
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52404
Diffstat (limited to 'subprojects')
0 files changed, 0 insertions, 0 deletions