oss-fuzz 52636: Check ref type before using

For Type42/TTF fonts we store the sfnts data in an array of strings, which the
FAPI code "seeks" through to read the font data. In this case, one of the
elements in the array is an integer rather than string, and since we weren't
checking the ref type, using is as a string would crash.

Add a check for the ref type, and throw an error if it's not a string.

1 files changed, 4 insertions, 0 deletions

diff --git a/psi/zfapi.c b/psi/zfapi.c
index aa7369a1e..6852e718c 100644
--- a/psi/zfapi.c
+++ b/psi/zfapi.c
@@ -103,6 +103,10 @@ sfnts_next_elem(sfnts_reader *r)
             r->error = code;
             return;
         }
+        if (!r_has_type(&s, t_string)) {
+            r->error = gs_note_error(gs_error_typecheck);
+            return;
+        }
     	r->p = s.value.const_bytes;
     	r->length = r_size(&s) & ~(uint) 1; /* See Adobe Technical Note # 5012, section 4.2. */
     } while (r->length == 0);