shithub: freetype+ttf2subf

Download patch

ref: ba8a528b1963a6803a4176db7a1dd545ff289bdb
parent: 2961b66c705a618d2ae2c1eb4a15689831a719ce
author: Bungeman <[email protected]>
date: Mon Oct 19 19:27:06 EDT 2015 

[cid] Better handle invalid glyph stream offsets (#46221).

* src/cid/cidgload.c (cid_load_glyph): Check minimum size of glyph
length.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-18  Bungeman  <[email protected]>
+
+	[cid] Better handle invalid glyph stream offsets (#46221).
+
+	* src/cid/cidgload.c (cid_load_glyph): Check minimum size of glyph
+	length.
+
 2015-10-18  Werner Lemberg  <[email protected]>
 
 	[psaux] Fix tracing of negative numbers.
--- a/src/cid/cidgload.c
+++ b/src/cid/cidgload.c
@@ -157,6 +157,12 @@
 
       /* Adjustment for seed bytes. */
       cs_offset = decoder->lenIV >= 0 ? (FT_UInt)decoder->lenIV : 0;
+      if ( cs_offset > glyph_length )
+      {
+        FT_TRACE0(( "cid_load_glyph: invalid glyph stream offsets\n" ));
+        error = FT_THROW( Invalid_Offset );
+        goto Exit;
+      }
 
       /* Decrypt only if lenIV >= 0. */
       if ( decoder->lenIV >= 0 )