shithub: freetype+ttf2subf

Download patch

ref: 4dc0d48f7bf939f893bc203239600fc56c63e39c
parent: 2550fc75a56f18aff2a6543a1ad07724b5f97767
author: Werner Lemberg <[email protected]>
date: Sat Aug 18 10:39:20 EDT 2018 

[psaux] Avoid slow PS font parsing in case of error.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955

* src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even
in case of error to avoid potential re-scanning.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,15 @@
-2018-08-14  Werner Lemberg  <[email protected]>
+2018-08-18  Werner Lemberg  <[email protected]>
+
+	[psaux] Avoid slow PS font parsing in case of error.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955
+
+	* src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even
+	in case of error to avoid potential re-scanning.
+
+2018-08-18  Werner Lemberg  <[email protected]>
 
 	[cff] Fix heap buffer overflow in old engine.
 
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -1447,6 +1447,8 @@
                                           bytes,
                                           max_bytes );
 
+    parser->cursor = cur;
+
     if ( delimiters )
     {
       if ( cur < parser->limit && *cur != '>' )
@@ -1456,10 +1458,8 @@
         goto Exit;
       }
 
-      cur++;
+      parser->cursor++;
     }
-
-    parser->cursor = cur;
 
   Exit:
     return error;