From ae04679a08f39597907c28c317062b1f22ecf8f8 Mon Sep 17 00:00:00 2001 From: Adrian Johnson Date: Fri, 23 Jul 2021 18:32:44 +0930 Subject: [PATCH] truetype: check cmap size before allocating memory Fixes #264 --- src/cairo-truetype-subset.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/cairo-truetype-subset.c b/src/cairo-truetype-subset.c index f5f06defc..efb67f9a6 100644 --- a/src/cairo-truetype-subset.c +++ b/src/cairo-truetype-subset.c @@ -1297,6 +1297,10 @@ _cairo_truetype_reverse_cmap (cairo_scaled_font_t *scaled_font, return CAIRO_INT_STATUS_UNSUPPORTED; size = be16_to_cpu (map_header.length); + /* minimum table size is 24 bytes */ + if (size < 24) + return CAIRO_INT_STATUS_UNSUPPORTED; + map = _cairo_malloc (size); if (unlikely (map == NULL)) return _cairo_error (CAIRO_STATUS_NO_MEMORY);