shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[pshinter] Avoid accessing uninitialized zone.

The `normal_top.count` may be 0, implying no `normal_top.zones` exist.
The code must not access these (non-existent) `normal_top.zones`.

* src/pshinter/pshalgo.c (ps_hints_apply): Do not assume that
`normal_top.zones[0]` is initialized. Test `normal_top.count`
before using `normal_top.zones[0]`. Do not rescale if there are no
`zones`.

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43675

git/fs: mount .git/fs: mount/attach disallowed

--- a/src/pshinter/pshalgo.c

+++ b/src/pshinter/pshalgo.c

@@ -2110,14 +2110,17 @@

       FT_Fixed  old_x_scale = x_scale;

       FT_Fixed  old_y_scale = y_scale;

-      FT_Fixed  scaled;

-      FT_Fixed  fitted;

+      FT_Fixed  scaled = 0;

+      FT_Fixed  fitted = 0;

       FT_Bool  rescale = FALSE;

-      scaled = FT_MulFix( globals->blues.normal_top.zones->org_ref, y_scale );

-      fitted = FT_PIX_ROUND( scaled );

+      if ( globals->blues.normal_top.count )

+      {

+        scaled = FT_MulFix( globals->blues.normal_top.zones->org_ref, y_scale );

+        fitted = FT_PIX_ROUND( scaled );

+      }

       if ( fitted != 0 && scaled != fitted )

       {