shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[truetype] Another GX sanity test.

* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Check
`tupleCount'.
Add tracing message.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,5 +1,13 @@

 2015-10-13  Werner Lemberg  <[email protected]>

+	[truetype] Another GX sanity test.

+

+	* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Check

+	`tupleCount'.

+	Add tracing message.

+

+2015-10-13  Werner Lemberg  <[email protected]>

+

 	[truetype] Fix memory leak for broken GX fonts (#46188).

 	* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Fix scope of

--- a/src/truetype/ttgxvar.c

+++ b/src/truetype/ttgxvar.c

@@ -1864,8 +1864,20 @@

       goto Fail2;

     tupleCount   = FT_GET_USHORT();

-    offsetToData = glyph_start + FT_GET_USHORT();

+    offsetToData = FT_GET_USHORT();

+    /* rough sanity test */

+    if ( offsetToData + tupleCount * 4 > stream->size - stream->pos )

+    {

+      FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"

+                  " invalid glyph variation array header\n" ));

+

+      error = FT_THROW( Invalid_Table );

+      goto Fail2;

+    }

+

+    offsetToData += glyph_start;

+

     if ( tupleCount & GX_TC_TUPLES_SHARE_POINT_NUMBERS )

     {

       here = FT_Stream_FTell( stream );

@@ -1901,6 +1913,9 @@

       }

       else if ( ( tupleIndex & GX_TI_TUPLE_INDEX_MASK ) >= blend->tuplecount )

       {

+        FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"

+                    " invalid tuple index\n" ));

+

         error = FT_THROW( Invalid_Table );

         goto Fail2;

       }