ref: 7d911736439e31fe71c816286e7a764612bf520d
parent: 75787c19eab20874c5d588842c52e59cfbd9302a
author: Werner Lemberg <[email protected]>
date: Sat Jun 26 05:29:51 EDT 2010
Fix Savannah bug #30262. * src/sfnt/ttload.c (tt_face_load_maxp): Limit `maxComponentDepth' arbitrarily to 100 to avoid stack exhaustion.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,11 @@
-2010-06-25 Werner Lemberg <[email protected]>
+2010-06-26 Werner Lemberg <[email protected]>
+
+ Fix Savannah bug #30262.
+
+ * src/sfnt/ttload.c (tt_face_load_maxp): Limit `maxComponentDepth'
+ arbitrarily to 100 to avoid stack exhaustion.
+
+2010-06-26 Werner Lemberg <[email protected]>
Add some memory checks (mainly for debugging).
--- a/src/sfnt/ttload.c
+++ b/src/sfnt/ttload.c
@@ -5,7 +5,8 @@
/* Load the basic TrueType tables, i.e., tables that can be either in */
/* TTF or OTF fonts (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, */
+/* 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -693,6 +694,15 @@
" some glyphs might be rendered incorrectly\n" ));
maxProfile->maxTwilightPoints = 0xFFFFU - 4;
+ }
+
+ /* we arbitrarily limit recursion to avoid stack exhaustion */
+ if ( maxProfile->maxComponentDepth > 100 )
+ {+ FT_TRACE0(( "tt_face_load_maxp:"
+ " abnormally large component depth (%d) set to 100\n",
+ maxProfile->maxComponentDepth ));
+ maxProfile->maxComponentDepth = 100;
}
}