|
 |
43e195 |
From 677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891 Mon Sep 17 00:00:00 2001
|
|
|
43e195 |
From: Werner Lemberg <wl@gnu.org>
|
|
|
43e195 |
Date: Wed, 12 Nov 2014 20:26:44 +0000
|
|
|
43e195 |
Subject: [sfnt] Fix Savannah bug #43590.
|
|
|
43e195 |
|
|
|
43e195 |
* src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir):
|
|
|
43e195 |
Protect against addition overflow.
|
|
|
43e195 |
---
|
|
|
43e195 |
diff --git a/src/sfnt/ttload.c b/src/sfnt/ttload.c
|
|
|
43e195 |
index 0a3cd29..8338150 100644
|
|
|
43e195 |
--- a/src/sfnt/ttload.c
|
|
|
43e195 |
+++ b/src/sfnt/ttload.c
|
|
|
43e195 |
@@ -5,7 +5,7 @@
|
|
|
43e195 |
/* Load the basic TrueType tables, i.e., tables that can be either in */
|
|
|
43e195 |
/* TTF or OTF fonts (body). */
|
|
|
43e195 |
/* */
|
|
|
43e195 |
-/* Copyright 1996-2010, 2012 by */
|
|
|
43e195 |
+/* Copyright 1996-2010, 2012-2014 by */
|
|
|
43e195 |
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
|
|
|
43e195 |
/* */
|
|
|
43e195 |
/* This file is part of the FreeType project, and may only be used, */
|
|
|
43e195 |
@@ -207,7 +207,10 @@
|
|
|
43e195 |
}
|
|
|
43e195 |
|
|
|
43e195 |
/* we ignore invalid tables */
|
|
|
43e195 |
- if ( table.Offset + table.Length > stream->size )
|
|
|
43e195 |
+
|
|
|
43e195 |
+ /* table.Offset + table.Length > stream->size ? */
|
|
|
43e195 |
+ if ( table.Length > stream->size ||
|
|
|
43e195 |
+ table.Offset > stream->size - table.Length )
|
|
|
43e195 |
{
|
|
|
43e195 |
FT_TRACE2(( "check_table_dir: table entry %d invalid\n", nn ));
|
|
|
43e195 |
continue;
|
|
|
43e195 |
@@ -398,7 +398,10 @@
|
|
|
43e195 |
entry->Length = FT_GET_LONG();
|
|
|
43e195 |
|
|
|
43e195 |
/* ignore invalid tables */
|
|
|
43e195 |
- if ( entry->Offset + entry->Length > stream->size )
|
|
|
43e195 |
+
|
|
|
43e195 |
+ /* entry->Offset + entry->Length > stream->size ? */
|
|
|
43e195 |
+ if ( entry->Length > stream->size ||
|
|
|
43e195 |
+ entry->Offset > stream->size - entry->Length )
|
|
|
43e195 |
continue;
|
|
|
43e195 |
else
|
|
|
43e195 |
{
|
|
|
43e195 |
--
|
|
|
43e195 |
cgit v0.9.0.2
|