mirrors
/
freetype
mirror of https://github.com/freetype/freetype
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[type1] Protect against invalid number of subroutines (#46150). 

* src/type1/t1load.c (parse_subrs): Check number of
`Subrs' dictionary entries against size of data stream.
This commit is contained in:
Werner Lemberg 2015-10-08 08:55:15 +02:00
parent dde84f2539
commit 121122416d
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2015-10-08 Werner Lemberg <wl@gnu.org>
[type1] Protect against invalid number of subroutines (#46150).
* src/type1/t1load.c (parse_subrs): Check number of
`Subrs' dictionary entries against size of data stream.
2015-10-07 Kostya Serebryany <kcc@google.com>
[ftfuzzer] Add support for LLVM's LibFuzzer.

15
src/type1/t1load.c
View File

@ -1420,6 +1420,21 @@
}
num_subrs = (FT_Int)T1_ToInt( parser );
if ( num_subrs < 0 )
{
parser->root.error = FT_THROW( Invalid_File_Format );
return;
}
/* we certainly need more than 8 bytes per subroutine */
if ( num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
{
FT_TRACE0(( "parse_subrs: adjusting number of subroutines"
" (from %d to %d)\n",
num_subrs,
( parser->root.limit - parser->root.cursor ) >> 3 ));
num_subrs = ( parser->root.limit - parser->root.cursor ) >> 3;
}
/* position the parser right before the `dup' of the first subr */
T1_Skip_PS_Token( parser ); /* `array' */