shithub: freetype+ttf2subf

Download patch

ref: 0a05ba257b6ddd87dacf8d54b626e4b360e0a596
parent: 0545ec1ca36b27cb928128870a83e5f668980bc5
author: Werner Lemberg <[email protected]>
date: Fri Mar 20 03:19:45 EDT 2009 

Protect against malformed compressed data.

Problem reported by Tavis Ormandy <[email protected]>.

* src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is
zero.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
 2009-03-20  Werner Lemberg  <[email protected]>
 
+	Protect against malformed compressed data.
+
+	Problem reported by Tavis Ormandy <[email protected]>.
+
+	* src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is
+	zero.
+
+2009-03-20  Werner Lemberg  <[email protected]>
+
 	Protect against invalid SID values in CFFs.
 
 	Problem reported by Tavis Ormandy <[email protected]>.
--- a/src/lzw/ftzopen.c
+++ b/src/lzw/ftzopen.c
@@ -332,6 +332,9 @@
 
           while ( code >= 256U )
           {
+            if ( !state->prefix )
+              goto Eof;
+
             FTLZW_STACK_PUSH( state->suffix[code - 256] );
             code = state->prefix[code - 256];
           }