shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[cff] Better check of number of blends.

* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdBLEND>,
src/cff/cffparse.c (cff_parse_blend): Compare number of blends with
stack size.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,11 @@

+2016-12-28  Werner Lemberg  <[email protected]>

+

+	[cff] Better check of number of blends.

+

+	* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdBLEND>,

+	src/cff/cffparse.c (cff_parse_blend): Compare number of blends with

+	stack size.

+

 2016-12-27  Werner Lemberg  <[email protected]>

 	Documentation updates.

--- a/src/cff/cf2intrp.c

+++ b/src/cff/cf2intrp.c

@@ -693,12 +693,13 @@

           }

           /* do the blend */

+          numBlends = (FT_UInt)cf2_stack_popInt( opStack );

+          if ( numBlends > stackSize )

           {

-            FT_Int  temp = cf2_stack_popInt( opStack );

-

-

-            numBlends = temp > 0 ? (FT_UInt)temp : 0;

+            lastError = FT_THROW( Invalid_Glyph_Format );

+            goto exit;

           }

+

           cf2_doBlend( &font->blend, opStack, numBlends );

           font->blend.usedBV = TRUE;

--- a/src/cff/cffparse.c

+++ b/src/cff/cffparse.c

@@ -907,6 +907,12 @@

     }

     numBlends = (FT_UInt)cff_parse_num( parser, parser->top - 1 );

+    if ( numBlends > parser->stackSize )

+    {

+      FT_ERROR(( "cff_parse_blend: Invalid number of blends\n" ));

+      error = FT_THROW( Invalid_File_Format );

+      goto Exit;

+    }

     FT_TRACE4(( "   %d values blended\n", numBlends ));