ref: d1c23082b65824824457fc02435e5c8cfd23817f
parent: 9206eba291017e9917d5e17e94ea6d4fcbca9f0f
author: suzuki toshiya <[email protected]>
date: Fri Jul 31 20:32:17 EDT 2009
truetype: Check invalid function number in FDEF instruction.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2009-07-31 suzuki toshiya <[email protected]>
+ truetype: Check invalid function number in FDEF instruction.
+
+ * src/truetype/ttinterp.c (Ins_FDEF): Check
+ if the operand fits 16-bit function number.
+
+2009-07-31 suzuki toshiya <[email protected]>
+
truetype: Truncate the deltas of composite glyph at 16-bit values.
* src/truetype/ttgload.c (load_truetype_glyph):
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -4290,13 +4290,21 @@
CUR.numFDefs++;
}
+ /* Although FDEF takes unsigned 32-bit integer, */
+ /* func # must be within unsigned 16-bit integer */
+ if ( n > 0xFFFFU )
+ {+ CUR.error = TT_Err_Too_Many_Function_Defs;
+ return;
+ }
+
rec->range = CUR.curRange;
- rec->opc = n;
+ rec->opc = (FT_UInt16)n;
rec->start = CUR.IP + 1;
rec->active = TRUE;
if ( n > CUR.maxFunc )
- CUR.maxFunc = n;
+ CUR.maxFunc = (FT_UInt16)n;
/* Now skip the whole function definition. */
/* We don't allow nested IDEFS & FDEFs. */