shithub: freetype+ttf2subf

Download patch

ref: a115142057f98104cbe745be9ed9175fd7357e43
parent: d1c23082b65824824457fc02435e5c8cfd23817f
author: suzuki toshiya <[email protected]>
date: Fri Jul 31 20:32:18 EDT 2009 

truetype: Check invalid function number in IDEF instruction.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2009-07-31  suzuki toshiya <[email protected]>
 
+	truetype: Check invalid function number in IDEF instruction.
+
+	* src/truetype/ttinterp.c (Ins_IDEF): Check
+	if the operand fits to 8-bit opcode limitation.
+
+2009-07-31  suzuki toshiya <[email protected]>
+
 	truetype: Check invalid function number in FDEF instruction.
 
 	* src/truetype/ttinterp.c (Ins_FDEF): Check
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -4561,13 +4561,20 @@
       CUR.numIDefs++;
     }
 
-    def->opc    = args[0];
+    /* opcode must be unsigned 8-bit integer */
+    if ( 0 > args[0] || args[0] > 0x00FF )
+    {
+      CUR.error = TT_Err_Too_Many_Instruction_Defs;
+      return;
+    }
+
+    def->opc    = (FT_Byte)args[0];
     def->start  = CUR.IP+1;
     def->range  = CUR.curRange;
     def->active = TRUE;
 
     if ( (FT_ULong)args[0] > CUR.maxIns )
-      CUR.maxIns = args[0];
+      CUR.maxIns = (FT_Byte)args[0];
 
     /* Now skip the whole function definition. */
     /* We don't allow nested IDEFs & FDEFs.    */