shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[sfnt] Fix Savannah bug #43591.

* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
and multiplication overflow.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,5 +1,12 @@

 2014-11-12  Werner Lemberg  <[email protected]>

+	[sfnt] Fix Savannah bug #43591.

+

+	* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition

+	and multiplication overflow.

+

+2014-11-12  Werner Lemberg  <[email protected]>

+

 	[sfnt] Fix Savannah bug #43590.

 	* src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir):

--- a/src/sfnt/ttsbit.c

+++ b/src/sfnt/ttsbit.c

@@ -394,9 +394,11 @@

       p                          += 34;

       decoder->bit_depth          = *p;

-      if ( decoder->strike_index_array > face->sbit_table_size             ||

-           decoder->strike_index_array + 8 * decoder->strike_index_count >

-             face->sbit_table_size                                         )

+      /* decoder->strike_index_array +                               */

+      /*   8 * decoder->strike_index_count > face->sbit_table_size ? */

+      if ( decoder->strike_index_array > face->sbit_table_size           ||

+           decoder->strike_index_count >

+             ( face->sbit_table_size - decoder->strike_index_array ) / 8 )

         error = FT_THROW( Invalid_File_Format );

     }