[freetype2] master d98053c: [pcf] Protect against invalid number of TOC entries (#46159).

[Werner LEMBERG]

branch: master
commit d98053c9971b6305861d301a9d5e9ed6fe18a4f9
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [pcf] Protect against invalid number of TOC entries (#46159).
    
    * src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
    against size of data stream.
---
 ChangeLog         |    7 +++++++
 src/pcf/pcfread.c |   14 +++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f4e30c6..a22466b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2015-10-08  Werner Lemberg  <address@hidden>
 
+       [pcf] Protect against invalid number of TOC entries (#46159).
+
+       * src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
+       against size of data stream.
+
+2015-10-08  Werner Lemberg  <address@hidden>
+
        [type42] Protect against invalid number of glyphs (#46159).
 
        * src/type42/t42parse.c (t42_parse_charstrings): Check number of
diff --git a/src/pcf/pcfread.c b/src/pcf/pcfread.c
index afa1480..afad278 100644
--- a/src/pcf/pcfread.c
+++ b/src/pcf/pcfread.c
@@ -102,11 +102,19 @@ THE SOFTWARE.
          FT_STREAM_READ_FIELDS( pcf_toc_header, toc ) )
       return FT_THROW( Cannot_Open_Resource );
 
-    if ( toc->version != PCF_FILE_VERSION                 ||
-         toc->count   >  FT_ARRAY_MAX( face->toc.tables ) ||
-         toc->count   == 0                                )
+    if ( toc->version != PCF_FILE_VERSION ||
+         toc->count   == 0                )
       return FT_THROW( Invalid_File_Format );
 
+    /* we need 16 bytes per TOC entry */
+    if ( toc->count > stream->size >> 4 )
+    {
+      FT_TRACE0(( "pcf_read_TOC: adjusting number of tables"
+                  " (from %d to %d)\n",
+                  toc->count, stream->size >> 4 ));
+      toc->count = stream->size >> 4;
+    }
+
     if ( FT_NEW_ARRAY( face->toc.tables, toc->count ) )
       return FT_THROW( Out_Of_Memory );