mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* src/cid/cidload.c (cid_face_open): Streamline SubrCount check.

Browse Source
This commit is contained in:
Alexei Podtelezhnikov 2021-10-07 22:44:53 -04:00
parent 0313a11c4c
commit 946df22165
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/cid/cidload.c
View File

@ -902,11 +902,10 @@
goto Exit;
}
/* `num_subrs' is scanned as a signed integer */
if ( (FT_Int)dict->num_subrs < 0 ||
( dict->sd_bytes &&
dict->num_subrs > ( binary_length - dict->subrmap_offset ) /
dict->sd_bytes ) )
/* The first condition prevents the multiplication overflow */
if ( dict->num_subrs > UINT_MAX / 4 ||
dict->num_subrs * dict->sd_bytes >
binary_length - dict->subrmap_offset )
{
FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" ));
error = FT_THROW( Invalid_File_Format );