mirrors
/
freetype
mirror of https://github.com/freetype/freetype
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[truetype] Fix UBSan warnings on adding offsets to nullptr. 

Reported as

  https://bugs.chromium.org/p/chromium/issues/detail?id=1032152

* src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.
This commit is contained in:
Werner Lemberg 2019-12-16 11:07:58 +01:00
parent 0c14a3adb0
commit 7e1b39f6cd
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,3 +1,13 @@
2019-12-16 Werner Lemberg <wl@gnu.org>
[truetype] Fix UBSan warnings on adding offsets to nullptr.
Reported as
https://bugs.chromium.org/p/chromium/issues/detail?id=1032152
* src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.
2019-12-14 Werner Lemberg <wl@gnu.org>
[truetype] Fix integer overflow.

4
src/truetype/ttinterp.c
View File

@ -3718,7 +3718,7 @@
/* We will then parse the current table. */
rec = exc->FDefs;
limit = rec + exc->numFDefs;
limit = FT_OFFSET( rec, exc->numFDefs );
n = (FT_ULong)args[0];
for ( ; rec < limit; rec++ )
@ -4150,7 +4150,7 @@
/* First of all, look for the same function in our table */
def = exc->IDefs;
limit = def + exc->numIDefs;
limit = FT_OFFSET( def, exc->numIDefs );
for ( ; def < limit; def++ )
if ( def->opc == (FT_ULong)args[0] )