[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master 7eeaf98: [truetype] Fix handling of `cvar' table data
From: |
Werner LEMBERG |
Subject: |
[freetype2] master 7eeaf98: [truetype] Fix handling of `cvar' table data. |
Date: |
Fri, 14 Oct 2016 06:58:34 +0000 (UTC) |
branch: master
commit 7eeaf986b5ebb43cbbc8368c6e528ac311d87805
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[truetype] Fix handling of `cvar' table data.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
* src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
indices.
---
ChangeLog | 11 +++++++++++
src/truetype/ttgxvar.c | 9 +++++++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index dc4232f..6b54ef0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2016-10-14 Werner Lemberg <address@hidden>
+
+ [truetype] Fix handling of `cvar' table data.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
+
+ * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
+ indices.
+
2016-10-11 Werner Lemberg <address@hidden>
[psaux] Fix handling of invalid flex subrs.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 52d612e..11b2908 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1552,10 +1552,15 @@
for ( j = 0; j < point_count; j++ )
{
- int pindex = localpoints[j];
- FT_Long orig_cvt = face->cvt[pindex];
+ int pindex;
+ FT_Long orig_cvt;
+ pindex = localpoints[j];
+ if ( (FT_ULong)pindex >= face->cvt_size )
+ continue;
+
+ orig_cvt = face->cvt[pindex];
face->cvt[pindex] = (FT_Short)( orig_cvt +
FT_MulFix( deltas[j], apply ) );
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master 7eeaf98: [truetype] Fix handling of `cvar' table data.,
Werner LEMBERG <=