shithub: freetype+ttf2subf

Download patch

ref: e9f0cdb6c0f44edcebc3ceb9d102f48f4aebd055
parent: 1c70fcbc0aab13aed5bfe757553d0bbe6ab9461c
author: Werner Lemberg <[email protected]>
date: Sun Jun 27 08:34:19 EDT 2010 

[cff] Protect against invalid `hintmask' and `cntrmask' operators.

* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Ensure that we don't exceed `limit' while parsing
the bit masks of the `hintmask' and `cntrmask' operators.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010-06-27  Werner Lemberg  <[email protected]>
+
+	[cff] Protect against invalid `hintmask' and `cntrmask' operators.
+
+	* src/cff/cffgload.c (cff_decoder_parse_charstrings)
+	<cff_op_hintmask>: Ensure that we don't exceed `limit' while parsing
+	the bit masks of the `hintmask' and `cntrmask' operators.
+
 2010-06-26  Werner Lemberg  <[email protected]>
 
 	Fix PFR change 2010-06-24.
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -1341,6 +1341,14 @@
 
           if ( hinter )
           {
+            /* In a valid charstring there must be at least three bytes */
+            /* after `hintmask' or `cntrmask' (two for a `moveto'       */
+            /* operator and one for `endchar').  Additionally, there    */
+            /* must be space for `num_hints' bits.                      */
+
+            if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
+              goto Syntax_Error;
+
             if ( op == cff_op_hintmask )
               hinter->hintmask( hinter->hints,
                                 builder->current->n_points,
@@ -1360,7 +1368,7 @@
             FT_TRACE4(( " (maskbytes:" ));
 
             for ( maskbyte = 0;
-                  maskbyte < (FT_UInt)(( decoder->num_hints + 7 ) >> 3);
+                  maskbyte < (FT_UInt)( ( decoder->num_hints + 7 ) >> 3 );
                   maskbyte++, ip++ )
               FT_TRACE4(( " 0x%02X", *ip ));