mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* src/cid/cidload.c (cid_face_open): Streamline CIDCount check.

Browse Source
This commit is contained in:
Alexei Podtelezhnikov 2021-10-08 22:14:12 -04:00
parent 946df22165
commit 012b4f2d48
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
src/cid/cidload.c
View File

@ -776,7 +776,6 @@
CID_FaceInfo cid = &face->cid;
FT_ULong binary_length;
FT_ULong entry_len;
cid_init_loader( &loader, face );
@ -853,7 +852,24 @@
}
binary_length = face->cid_stream->size - cid->data_offset;
entry_len = cid->fd_bytes + cid->gd_bytes;
if ( cid->cidmap_offset > binary_length )
{
FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
/* the initial pre-check prevents the multiplication overflow */
if ( cid->cid_count > FT_ULONG_MAX / 8 ||
cid->cid_count * ( cid->fd_bytes + cid->gd_bytes ) >
binary_length - cid->cidmap_offset )
{
FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
for ( n = 0; n < cid->num_dicts; n++ )
{
@ -902,8 +918,8 @@
goto Exit;
}
/* The first condition prevents the multiplication overflow */
if ( dict->num_subrs > UINT_MAX / 4 ||
/* the initial pre-check prevents the multiplication overflow */
if ( dict->num_subrs > FT_UINT_MAX / 4 ||
dict->num_subrs * dict->sd_bytes >
binary_length - dict->subrmap_offset )
{
@ -913,22 +929,6 @@
}
}
if ( cid->cidmap_offset > binary_length )
{
FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
if ( entry_len &&
cid->cid_count >
( binary_length - cid->cidmap_offset ) / entry_len )
{
FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
/* we can now safely proceed */
error = cid_read_subrs( face );