shithub: freetype+ttf2subf

Download patch

ref: d98053c9971b6305861d301a9d5e9ed6fe18a4f9
parent: 06c2d3324e8a8dbe153d51129adadd8d8eb4f834
author: Werner Lemberg <[email protected]>
date: Thu Oct 8 19:17:41 EDT 2015 

[pcf] Protect against invalid number of TOC entries (#46159).

* src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
against size of data stream.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2015-10-08  Werner Lemberg  <[email protected]>
 
+	[pcf] Protect against invalid number of TOC entries (#46159).
+
+	* src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
+	against size of data stream.
+
+2015-10-08  Werner Lemberg  <[email protected]>
+
 	[type42] Protect against invalid number of glyphs (#46159).
 
 	* src/type42/t42parse.c (t42_parse_charstrings): Check number of
--- a/src/pcf/pcfread.c
+++ b/src/pcf/pcfread.c
@@ -102,10 +102,18 @@
          FT_STREAM_READ_FIELDS( pcf_toc_header, toc ) )
       return FT_THROW( Cannot_Open_Resource );
 
-    if ( toc->version != PCF_FILE_VERSION                 ||
-         toc->count   >  FT_ARRAY_MAX( face->toc.tables ) ||
-         toc->count   == 0                                )
+    if ( toc->version != PCF_FILE_VERSION ||
+         toc->count   == 0                )
       return FT_THROW( Invalid_File_Format );
+
+    /* we need 16 bytes per TOC entry */
+    if ( toc->count > stream->size >> 4 )
+    {
+      FT_TRACE0(( "pcf_read_TOC: adjusting number of tables"
+                  " (from %d to %d)\n",
+                  toc->count, stream->size >> 4 ));
+      toc->count = stream->size >> 4;
+    }
 
     if ( FT_NEW_ARRAY( face->toc.tables, toc->count ) )
       return FT_THROW( Out_Of_Memory );