mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[truetype] Better protection against invalid VF data.

Browse Source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5739

Bug introduced in commit 08cd62deed.

* src/truetype/ttgxvar.c (TT_Set_Var_Design): Always initialize
`normalizedcoords'.
This commit is contained in:
Werner Lemberg 2018-01-27 23:59:30 +01:00
parent 29c759284e
commit 68dddcdcbe
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
ChangeLog
View File

@ -1,3 +1,16 @@
2018-01-27 Werner Lemberg <wl@gnu.org>
[truetype] Better protection against invalid VF data.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5739
Bug introduced in commit 08cd62deedefe217f2ea50e392923ce8b5bc7ac7.
* src/truetype/ttgxvar.c (TT_Set_Var_Design): Always initialize
`normalizedcoords'.
2018-01-27 Werner Lemberg <wl@gnu.org>
* src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL reference.

5
src/truetype/ttgxvar.c
View File

@ -2821,8 +2821,9 @@
}
}
/* return value -1 indicates `no change' */
if ( !have_diff )
/* return value -1 indicates `no change'; */
/* we can exit early if `normalizedcoords' is already computed */
if ( blend->normalizedcoords && !have_diff )
return -1;
if ( FT_NEW_ARRAY( normalized, mmvar->num_axis ) )