fdo-mirrors/freetype
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/freetype/freetype.git synced 2026-04-27 15:30:40 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

[sfnt] Fix Savannah bug #43589.

Browse source 
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
overflow.
This commit is contained in:
Werner Lemberg 2014-11-12 21:06:08 +01:00
parent 602040b111
commit f46add1389
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ChangeLog
View file

@ -1,3 +1,10 @@
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43589.
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
overflow.
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43588.

6
src/sfnt/sfobjs.c
View file

@ -567,8 +567,10 @@
if ( table->Offset != woff_offset ||
table->Offset + table->CompLength > woff.length ||
sfnt_offset + table->OrigLength > woff.totalSfntSize ||
table->CompLength > woff.length ||
table->Offset > woff.length - table->CompLength ||
table->OrigLength > woff.totalSfntSize ||
sfnt_offset > woff.totalSfntSize - table->OrigLength ||
table->CompLength > table->OrigLength )
{
error = FT_THROW( Invalid_Table );