shithub: freetype+ttf2subf

Download patch

ref: 87fefc594eeea8064766b397c93d685e261e2989
parent: 3cfd51233c8b88f53097ebcef6bbb05e360d12b7
author: Werner Lemberg <[email protected]>
date: Wed Oct 21 16:29:12 EDT 2015 

[type42] Fix heap buffer overflow (#46269).

* src/type42/t42parse.c (t42_parse_sfnts): Fix off-by-one error in
bounds checking.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-21  Werner Lemberg  <[email protected]>
+
+	[type42] Fix heap buffer overflow (#46269).
+
+	* src/type42/t42parse.c (t42_parse_sfnts): Fix off-by-one error in
+	bounds checking.
+
 2015-10-21  Dave Arnold  <[email protected]>
 
 	[cff] Fix limit in assert for max hints.
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -640,7 +640,7 @@
 
         string_buf = parser->root.cursor + 1;   /* one space after `RD' */
 
-        if ( (FT_ULong)( limit - parser->root.cursor ) < string_size )
+        if ( (FT_ULong)( limit - parser->root.cursor ) <= string_size )
         {
           FT_ERROR(( "t42_parse_sfnts: too much binary data\n" ));
           error = FT_THROW( Invalid_File_Format );