shithub: freetype+ttf2subf

Download patch

ref: bebac3cf5b5596a8d3888c0a8c0e3c9df20da98c
parent: 09f0e0fcbef4d99f3be9312554d7bb1688911411
author: Werner Lemberg <[email protected]>
date: Mon May 16 16:16:35 EDT 2016 

[base] Reject invalid sfnt Mac resource (#47891).

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
of `CID ' and `TYPE1' table offset and length.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2016-05-16  Werner Lemberg  <[email protected]>
 
+	[base] Reject invalid sfnt Mac resource (#47891).
+
+	* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
+	of `CID ' and `TYPE1' table offset and length.
+
+2016-05-16  Werner Lemberg  <[email protected]>
+
 	[cid] Fix scanning for `StartData' and `/sfnts' (#47892).
 
 	* src/cid/cidparse.c (STARTDATA, STARTDATA_LEN, SFNTS, SFNTS_LEN):
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1483,6 +1483,7 @@
       if ( face_index >= 0 && pstable_index == face_index )
         return FT_Err_Ok;
     }
+
     return FT_THROW( Table_Missing );
   }
 
@@ -1520,6 +1521,19 @@
     if ( error )
       goto Exit;
 
+    if ( offset > stream->size )
+    {
+      FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table offset\n" ));
+      error = FT_THROW( Invalid_Table );
+      goto Exit;
+    }
+    else if ( length > stream->size - offset )
+    {
+      FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table length\n" ));
+      error = FT_THROW( Invalid_Table );
+      goto Exit;
+    }
+
     error = FT_Stream_Seek( stream, pos + offset );
     if ( error )
       goto Exit;
@@ -1528,7 +1542,8 @@
       goto Exit;
 
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
-    if ( error ) {
+    if ( error )
+    {
       FT_FREE( sfnt_ps );
       goto Exit;
     }