diff options
Diffstat (limited to 'src/sfnt/ttcolr.c')
| -rw-r--r-- | src/sfnt/ttcolr.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c index fa58a90a3..c3f225d66 100644 --- a/src/sfnt/ttcolr.c +++ b/src/sfnt/ttcolr.c @@ -702,6 +702,13 @@ p = iterator->p; /* + * First ensure that p is within COLRv1. + */ + if ( p < colr->base_glyphs_v1 || + p >= ( (FT_Byte*)colr->table + colr->table_size ) ) + return 0; + + /* * Do a cursor sanity check of the iterator. Counting backwards from * where it stands, we need to end up at a position after the beginning * of the `LayerV1List` table and not after the end of the |