shithub: freetype+ttf2subf

Download patch

ref: 50486df1e6a9a66d5df287efea94b8c1c14a1084
parent: 37c7b81794fc0499f02f8a434a66d350616f308b
author: Werner Lemberg <[email protected]>
date: Mon Aug 13 04:46:53 EDT 2018 

* src/type42/t42parse.c (t42_parse_sfnts): One more format check.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9832

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-08-13  Werner Lemberg  <[email protected]>
+
+	* src/type42/t42parse.c (t42_parse_sfnts): One more format check.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9832
+
 2018-08-11  Werner Lemberg  <[email protected]>
 
 	* src/base/ftcalc.c (FT_Matrix_Check): Fix integer overflow.
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -595,6 +595,14 @@
 
       else if ( *cur == '<' )
       {
+        if ( string_buf && !allocated )
+        {
+          FT_ERROR(( "t42_parse_sfnts: "
+                     "can't handle mixed binary and hex strings\n" ));
+          error = FT_THROW( Invalid_File_Format );
+          goto Fail;
+        }
+
         T1_Skip_PS_Token( parser );
         if ( parser->root.error )
           goto Exit;