fdo-mirrors/freetype
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/freetype/freetype.git synced 2026-05-05 10:08:12 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

* src/type1/t1load.c (parse_subrs): Fix limit check.

Browse source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
This commit is contained in:
Werner Lemberg 2016-10-26 08:10:59 +02:00
parent c5f1bc4b36
commit 5614090725
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
ChangeLog
View file

@ -1,3 +1,11 @@
2016-10-26 Werner Lemberg <wl@gnu.org>
* src/type1/t1load.c (parse_subrs): Fix limit check.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=81
2016-10-25 Alexei Podtelezhnikov <apodtele@gmail.com>
[cff] Correct cmap format reporting (#24819).

2
src/type1/t1load.c
View file

@ -1433,7 +1433,7 @@
}
/* we certainly need more than 8 bytes per subroutine */
if ( parser->root.limit > parser->root.cursor &&
if ( parser->root.limit >= parser->root.cursor &&
num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
{
/*