[freetype2] master bebac3c: [base] Reject invalid sfnt Mac resource (#47891).

[Werner LEMBERG]

branch: master
commit bebac3cf5b5596a8d3888c0a8c0e3c9df20da98c
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [base] Reject invalid sfnt Mac resource (#47891).
    
    * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
    of `CID ' and `TYPE1' table offset and length.
---
 ChangeLog         |    7 +++++++
 src/base/ftobjs.c |   17 ++++++++++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 02539f6..77e825b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2016-05-16  Werner Lemberg  <address@hidden>
 
+       [base] Reject invalid sfnt Mac resource (#47891).
+
+       * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Check validity
+       of `CID ' and `TYPE1' table offset and length.
+
+2016-05-16  Werner Lemberg  <address@hidden>
+
        [cid] Fix scanning for `StartData' and `/sfnts' (#47892).
 
        * src/cid/cidparse.c (STARTDATA, STARTDATA_LEN, SFNTS, SFNTS_LEN):
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index af38d04..ff6ac11 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1483,6 +1483,7 @@
       if ( face_index >= 0 && pstable_index == face_index )
         return FT_Err_Ok;
     }
+
     return FT_THROW( Table_Missing );
   }
 
@@ -1520,6 +1521,19 @@
     if ( error )
       goto Exit;
 
+    if ( offset > stream->size )
+    {
+      FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table offset\n" ));
+      error = FT_THROW( Invalid_Table );
+      goto Exit;
+    }
+    else if ( length > stream->size - offset )
+    {
+      FT_TRACE2(( "open_face_PS_from_sfnt_stream: invalid table length\n" ));
+      error = FT_THROW( Invalid_Table );
+      goto Exit;
+    }
+
     error = FT_Stream_Seek( stream, pos + offset );
     if ( error )
       goto Exit;
@@ -1528,7 +1542,8 @@
       goto Exit;
 
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
-    if ( error ) {
+    if ( error )
+    {
       FT_FREE( sfnt_ps );
       goto Exit;
     }