mirrors
/
freetype
mirror of https://github.com/freetype/freetype
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[truetype] Minor update to forthcoming OpenType 1.8.4 standard. 

* src/truetype/ttgxvar.c (ft_var_load_item_variation_store): Limit
size of `regionCount`.
This commit is contained in:
Werner Lemberg 2020-10-28 13:34:52 +01:00
parent 40c5681ab9
commit 804e625def
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2020-10-28 Werner Lemberg <wl@gnu.org>
[truetype] Minor update to forthcoming OpenType 1.8.4 standard.
* src/truetype/ttgxvar.c (ft_var_load_item_variation_store): Limit
size of `regionCount`.
2020-10-26 Werner Lemberg <wl@gnu.org>
* meson.build: Fix 'harfbuzz' and 'brotli' build options (#59347).

9
src/truetype/ttgxvar.c
View File

@ -493,6 +493,15 @@
goto Exit;
}
/* new constraint in OpenType 1.8.4 */
if ( itemStore->regionCount >= 32768U )
{
FT_TRACE2(( "ft_var_load_item_variation_store:"
" too many variation region tables\n" ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
if ( FT_NEW_ARRAY( itemStore->varRegionList, itemStore->regionCount ) )
goto Exit;