freetype-commit
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[freetype2] master 7eeaf98: [truetype] Fix handling of `cvar' table data


From: Werner LEMBERG
Subject: [freetype2] master 7eeaf98: [truetype] Fix handling of `cvar' table data.
Date: Fri, 14 Oct 2016 06:58:34 +0000 (UTC)

branch: master
commit 7eeaf986b5ebb43cbbc8368c6e528ac311d87805
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [truetype] Fix handling of `cvar' table data.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
    
    * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
    indices.
---
 ChangeLog              |   11 +++++++++++
 src/truetype/ttgxvar.c |    9 +++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index dc4232f..6b54ef0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2016-10-14  Werner Lemberg  <address@hidden>
+
+       [truetype] Fix handling of `cvar' table data.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53
+
+       * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT
+       indices.
+
 2016-10-11  Werner Lemberg  <address@hidden>
 
        [psaux] Fix handling of invalid flex subrs.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 52d612e..11b2908 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1552,10 +1552,15 @@
 
         for ( j = 0; j < point_count; j++ )
         {
-          int      pindex   = localpoints[j];
-          FT_Long  orig_cvt = face->cvt[pindex];
+          int      pindex;
+          FT_Long  orig_cvt;
 
 
+          pindex = localpoints[j];
+          if ( (FT_ULong)pindex >= face->cvt_size )
+            continue;
+
+          orig_cvt          = face->cvt[pindex];
           face->cvt[pindex] = (FT_Short)( orig_cvt +
                                           FT_MulFix( deltas[j], apply ) );
 



reply via email to

[Prev in Thread] Current Thread [Next in Thread]