ReFuel/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adjust table size comparisons (#54242).

Browse Source 
* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
This commit is contained in:
Werner Lemberg 2018-07-05 23:05:53 +02:00
parent 6ceeb87f5d
commit 0767d5362f
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2018-07-05 Werner Lemberg <wl@gnu.org>
Adjust table size comparisons (#54242).
* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
2018-07-05 Werner Lemberg <wl@gnu.org>
Fix more 32bit issues (#54208)

8
src/sfnt/ttcpal.c
View File

@ -112,6 +112,10 @@
cpal->num_colors = FT_NEXT_USHORT( p );
colors_offset = FT_NEXT_ULONG( p );
if ( CPAL_V0_HEADER_BASE_SIZE +
face->palette_data.num_palettes * 2U > table_size )
goto InvalidTable;
if ( colors_offset >= table_size )
goto InvalidTable;
if ( cpal->num_colors * COLOR_SIZE > table_size - colors_offset )
@ -128,7 +132,9 @@
FT_UShort* q;
if ( face->palette_data.num_palettes * 2 + 3U * 4 > table_size )
if ( CPAL_V0_HEADER_BASE_SIZE +
face->palette_data.num_palettes * 2U +
3U * 4 > table_size )
goto InvalidTable;
p += face->palette_data.num_palettes * 2;