shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[type1, type42] Another fix for Savannah bug #43655.

* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Add another boundary testing.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,5 +1,12 @@

 2014-11-24  Werner Lemberg  <[email protected]>

+	[type1, type42] Another fix for Savannah bug #43655.

+

+	* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c

+	(t42_parse_charstrings): Add another boundary testing.

+

+2014-11-24  Werner Lemberg  <[email protected]>

+

 	[docmaker] Formatting, copyright, improved documentation.

 	* src/tools/docmaker/*: No code changes besides trivial

--- a/src/type1/t1load.c

+++ b/src/type1/t1load.c

@@ -1596,6 +1596,11 @@

       }

       T1_Skip_PS_Token( parser );

+      if ( parser->root.cursor >= limit )

+      {

+        error = FT_THROW( Invalid_File_Format );

+        goto Fail;

+      }

       if ( parser->root.error )

         return;

--- a/src/type42/t42parse.c

+++ b/src/type42/t42parse.c

@@ -849,6 +849,12 @@

         break;

       T1_Skip_PS_Token( parser );

+      if ( parser->root.cursor >= limit )

+      {

+        FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));

+        error = FT_THROW( Invalid_File_Format );

+        goto Fail;

+      }

       if ( parser->root.error )

         return;