mirrors
/
freetype
mirror of https://github.com/freetype/freetype
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[sfnt] Pointer sanity checks before reading layer info in 'COLR' v0 

* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to
read from is within the 'COLR' table.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633
This commit is contained in:
Dominik Röttsches 2022-08-30 15:00:37 +03:00 committed by Werner Lemberg
parent 048f2e247c
commit 6d62076ae5
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/sfnt/ttcolr.c
View File

@ -481,7 +481,9 @@
iterator->p = colr->layers + offset;
}
if ( iterator->layer >= iterator->num_layers )
if ( iterator->layer >= iterator->num_layers ||
iterator->p < colr->layers ||
iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) )
return 0;
*aglyph_index = FT_NEXT_USHORT( iterator->p );