shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[winfonts] Check alignment shift count for resource data (#45938).

* src/winfonts/winfnt.c (fnt_face_get_dll_font): Implement it.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,5 +1,11 @@

 2015-09-13  Werner Lemberg  <[email protected]>

+	[winfonts] Check alignment shift count for resource data (#45938).

+

+	* src/winfonts/winfnt.c (fnt_face_get_dll_font): Implement it.

+

+2015-09-13  Werner Lemberg  <[email protected]>

+

 	[type1] Fix potential buffer overflow (#45923).

 	* src/type1/t1parse.c (T1_Get_Private_Dict): Assure `cur' doesn't

--- a/src/winfonts/winfnt.c

+++ b/src/winfonts/winfnt.c

@@ -320,6 +320,21 @@

         size_shift = FT_GET_USHORT_LE();

+        /* Microsoft's specification of the executable-file header format */

+        /* for `New Executable' (NE) doesn't give a limit for the         */

+        /* alignment shift count; however, in 1985, the year of the       */

+        /* specification release, only 32bit values were supported, thus  */

+        /* anything larger than 16 doesn't make sense in general, given   */

+        /* that file offsets are 16bit values, shifted by the alignment   */

+        /* shift count                                                    */

+        if ( size_shift > 16 )

+        {

+          FT_TRACE2(( "invalid alignment shift count for resource data\n" ));

+          error = FT_THROW( Invalid_File_Format );

+          goto Exit;

+        }

+

+

         for (;;)

         {

           FT_UShort  type_id, count;