diff options
author | Werner Lemberg <[email protected]> | 2016-10-14 08:58:17 +0200 |
---|---|---|
committer | Werner Lemberg <[email protected]> | 2016-10-14 08:58:17 +0200 |
commit | 7eeaf986b5ebb43cbbc8368c6e528ac311d87805 (patch) | |
tree | 33e846a53ea6be3b8391c36c27ddf7cb52c4dddd | |
parent | 83702957553fd130f62496cfbc31c2a73b22e852 (diff) | |
download | freetype2-7eeaf986b5ebb43cbbc8368c6e528ac311d87805.tar.gz |
[truetype] Fix handling of `cvar' table data.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
* src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
indices.
-rw-r--r-- | ChangeLog | 11 | ||||
-rw-r--r-- | src/truetype/ttgxvar.c | 9 |
2 files changed, 18 insertions, 2 deletions
@@ -1,3 +1,14 @@ +2016-10-14 Werner Lemberg <[email protected]> + + [truetype] Fix handling of `cvar' table data. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53 + + * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT + indices. + 2016-10-11 Werner Lemberg <[email protected]> [psaux] Fix handling of invalid flex subrs. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 52d612e..11b2908 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -1552,10 +1552,15 @@ for ( j = 0; j < point_count; j++ ) { - int pindex = localpoints[j]; - FT_Long orig_cvt = face->cvt[pindex]; + int pindex; + FT_Long orig_cvt; + pindex = localpoints[j]; + if ( (FT_ULong)pindex >= face->cvt_size ) + continue; + + orig_cvt = face->cvt[pindex]; face->cvt[pindex] = (FT_Short)( orig_cvt + FT_MulFix( deltas[j], apply ) ); |