[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master 235b1e2: [truetype]: Limit `SLOOP' bytecode argument
From: |
Werner LEMBERG |
Subject: |
[freetype2] master 235b1e2: [truetype]: Limit `SLOOP' bytecode argument to 16 bits. |
Date: |
Sun, 15 Apr 2018 15:55:19 -0400 (EDT) |
branch: master
commit 235b1e2fe6ca325f449c5a73c75432d62d73f524
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[truetype]: Limit `SLOOP' bytecode argument to 16 bits.
This fixes
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7707
* src/truetype/ttinterp.c (Ins_SLOOP): Do it.
---
ChangeLog | 10 ++++++++++
src/truetype/ttinterp.c | 5 ++++-
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index b929801..2f6bffc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2018-04-15 Werner Lemberg <address@hidden>
+
+ [truetype]: Limit `SLOOP' bytecode argument to 16 bits.
+
+ This fixes
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7707
+
+ * src/truetype/ttinterp.c (Ins_SLOOP): Do it.
+
2018-04-14 Werner Lemberg <address@hidden>
[truetype] Integer overflow issues.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index d9865d4..c66c699 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -3289,7 +3289,10 @@
if ( args[0] < 0 )
exc->error = FT_THROW( Bad_Argument );
else
- exc->GS.loop = args[0];
+ {
+ /* we heuristically limit the number of loops to 16 bits */
+ exc->GS.loop = args[0] > 0xFFFFL ? 0xFFFFL : args[0];
+ }
}
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master 235b1e2: [truetype]: Limit `SLOOP' bytecode argument to 16 bits.,
Werner LEMBERG <=