shithub: freetype+ttf2subf

Download patch

ref: e9a154e70015e602d695d65a588ecb38f5bb38cc
parent: 069083cccd73d1d68da68116c8d050bb62cdfe0e
author: Werner Lemberg <[email protected]>
date: Sat Dec 31 16:41:08 EST 2016 

[truetype] Check axis count in HVAR table.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362

* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
(ft_var_load_avar): Fix tracing message.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,15 @@
-2016-09-08  Werner Lemberg  <[email protected]>
+2016-12-31  Werner Lemberg  <[email protected]>
+
+	[truetype] Check axis count in HVAR table.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362
+
+	* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
+	(ft_var_load_avar): Fix tracing message.
+
+2016-12-30  Werner Lemberg  <[email protected]>
 
 	* Version 2.7.1 released.
 	=========================
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -346,7 +346,7 @@
 
     if ( axisCount != (FT_Long)blend->mmvar->num_axis )
     {
-      FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `cvar'\n"
+      FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `fvar'\n"
                   "                  table are different\n" ));
       goto Exit;
     }
@@ -520,6 +520,14 @@
       if ( FT_READ_USHORT( itemStore->axisCount )   ||
            FT_READ_USHORT( itemStore->regionCount ) )
         goto Exit;
+
+      if ( itemStore->axisCount != (FT_Long)blend->mmvar->num_axis )
+      {
+        FT_TRACE2(( "ft_var_load_hvar: number of axes in `hvar' and `fvar'\n"
+                    "                  table are different\n" ));
+        error = FT_THROW( Invalid_Table );
+        goto Exit;
+      }
 
       if ( FT_NEW_ARRAY( itemStore->varRegionList, itemStore->regionCount ) )
         goto Exit;