ReFuel/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[cff] Fix heap buffer overflow in old engine.

Browse Source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967

* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
non-zero.
This commit is contained in:
Werner Lemberg 2018-08-18 13:38:48 +02:00
parent c94162a220
commit 2550fc75a5
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
2018-08-14 Werner Lemberg <wl@gnu.org>
[cff] Fix heap buffer overflow in old engine.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
non-zero.
2018-08-16 Young Xiao <yangx92@hotmail.com>
* builds/mac/ftmac.c (parse_fond): Fix buffer overrun.

3
src/psaux/cffdecode.c
View File

@ -1935,6 +1935,7 @@
case cff_op_blend:
/* this operator was removed from the Type2 specification */
/* in version 16-March-2000 */
if ( num_designs )
{
FT_Int num_results = (FT_Int)( args[0] >> 16 );
@ -1953,6 +1954,8 @@
args -= num_results * ( num_designs - 1 );
num_args -= num_results * ( num_designs - 1 );
}
else
goto Syntax_Error;
break;
case cff_op_dotsection: