shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

* src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.

Problem reported by Dennis Felsing <[email protected]>.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,9 @@

+2014-12-11  Werner Lemberg  <[email protected]>

+

+	* src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.

+

+	Problem reported by Dennis Felsing <[email protected]>.

+

 2014-12-09  suzuki toshiya  <[email protected]>

 	[gxvalid] Fix a naming convention conflicting with ftvalid.

--- a/src/type42/t42parse.c

+++ b/src/type42/t42parse.c

@@ -580,6 +580,12 @@

         /* don't include delimiters */

         string_size = (FT_Long)( ( parser->root.cursor - cur - 2 + 1 ) / 2 );

+        if ( !string_size )

+        {

+          FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" ));

+          error = FT_THROW( Invalid_File_Format );

+          goto Fail;

+        }

         if ( FT_REALLOC( string_buf, old_string_size, string_size ) )

           goto Fail;