mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix handling of invalid format 2 cmaps.

Browse Source 
The problem was introduced after the last release.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7828

* src/sfnt/ttcmap.c (tt_cmap2_char_next): Avoid endless loop.
This commit is contained in:
Werner Lemberg 2018-04-19 14:45:19 +02:00
parent 2a1597826a
commit 1655e00fce
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
2018-03-13 Werner Lemberg <wl@gnu.org>
Fix handling of invalid format 2 cmaps.
The problem was introduced after the last release.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7828
* src/sfnt/ttcmap.c (tt_cmap2_char_next): Avoid endless loop.
2018-04-17 Werner Lemberg <wl@gnu.org>
[truetype] Integer overflow issues.

7
src/sfnt/ttcmap.c
View File

@ -518,6 +518,13 @@
FT_UInt pos, idx;
if ( char_lo > start + count )
{
/* this happens only for a malformed cmap */
charcode = 0x100;
continue;
}
if ( offset == 0 )
{
if ( charcode == 0x100 )