ref: a660e3de422731b94d4a134d27555430cbb6fb39
parent: 69ce97391cc2e7cbc4b6e2e7b7e62708a46280c6
author: Werner Lemberg <[email protected]>
date: Thu Aug 25 20:23:27 EDT 2016
[type1] Fix heap buffer overflow. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36 * src/type1/t1load.c (parse_charstrings): Reject fonts that don't contain glyph names.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2016-08-26 Werner Lemberg <[email protected]>
+
+ [type1] Fix heap buffer overflow.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36
+
+ * src/type1/t1load.c (parse_charstrings): Reject fonts that don't
+ contain glyph names.
+
2016-08-25 Werner Lemberg <[email protected]>
[sfnt] Fix previous commit (#48901).
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1776,6 +1776,12 @@
}
}
+ if ( !n )
+ {
+ error = FT_THROW( Invalid_File_Format );
+ goto Fail;
+ }
+
loader->num_glyphs = n;
/* if /.notdef is found but does not occupy index 0, do our magic. */