diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-14 09:30:45 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-14 10:16:05 +0100 |
| commit | 3c2aebbedd37fab054e80f2e315de07d7e9b5bdb (patch) | |
| tree | 0f9a650637789946fd2af79abd92028a1ed84269 /xps/xpsfont.c | |
| parent | c53183d4e7103e87368b7cfa15367a47d559e323 (diff) | |
| download | ghostpdl-3c2aebbedd37fab054e80f2e315de07d7e9b5bdb.tar.gz | |
Bug 698044: restrict font name length to the buffer size.
Diffstat (limited to 'xps/xpsfont.c')
| -rw-r--r-- | xps/xpsfont.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/xps/xpsfont.c b/xps/xpsfont.c index fa68e8281..36aef4cf0 100644 --- a/xps/xpsfont.c +++ b/xps/xpsfont.c @@ -163,7 +163,7 @@ xps_find_sfnt_table(xps_font_t *font, const char *name, int *lengthp) * Get the windows truetype font file name - position 4 in the name table. */ void -xps_load_sfnt_name(xps_font_t *font, char *namep) +xps_load_sfnt_name(xps_font_t *font, char *namep, const int buflen) { byte *namedata; int offset, length; @@ -219,6 +219,8 @@ xps_load_sfnt_name(xps_font_t *font, char *namep) length = u16(record + 8); offset = u16(record + 10); + length = length > buflen - 1 ? buflen - 1: length; + /* Full font name or postscript name */ if (nameid == 4 || nameid == 6) { |