shithub: freetype+ttf2subf

Download patch

ref: 35252ae9aa1dd9343e9f4884e9ddb1fee10ef415
parent: 240c94a185cd8dae7d03059abec8a5662c35ecd3
author: suzuki toshiya <[email protected]>
date: Wed Nov 26 10:52:23 EST 2014 

Fix Savannah bug #43539.

* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
by a broken POST table in resource-fork.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2014-11-26  suzuki toshiya  <[email protected]>
 
+	Fix Savannah bug #43539.
+
+	* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
+	by a broken POST table in resource-fork.
+
+2014-11-26  suzuki toshiya  <[email protected]>
+
 	Fix Savannah bug #43538.
 
 	* src/base/ftobjs.c (Mac_Read_POST_Resource): Fix integer overflow
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1617,6 +1617,11 @@
         goto Exit2;
       if ( FT_READ_LONG( rlen ) )
         goto Exit2;
+      if ( rlen < 0 )
+      {
+        error = FT_THROW( Invalid_Offset );
+        goto Exit2;
+      }
       if ( FT_READ_USHORT( flags ) )
         goto Exit2;
       FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
@@ -1634,7 +1639,14 @@
         rlen = 0;
 
       if ( ( flags >> 8 ) == type )
+      {
+        if ( 0x7FFFFFFFL - rlen < len )
+        {
+          error = FT_THROW( Array_Too_Large );
+          goto Exit2;
+        }
         len += rlen;
+      }
       else
       {
         if ( pfb_lenpos + 3 > pfb_len + 2 )
@@ -1663,6 +1675,11 @@
       }
 
       error = FT_ERR( Cannot_Open_Resource );
+      if ( rlen > 0x7FFFFFFFL - pfb_pos )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto Exit2;
+      }
       if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
         goto Exit2;