[freetype2] master 0767d53: Adjust table size comparisons (#54242).

[Werner LEMBERG]

branch: master
commit 0767d5362fdc2d14de842b264f24a6cb91d45d55
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    Adjust table size comparisons (#54242).
    
    * src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
---
 ChangeLog         | 6 ++++++
 src/sfnt/ttcpal.c | 8 +++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 0bcdb95..f193f6f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2018-07-05  Werner Lemberg  <address@hidden>
 
+       Adjust table size comparisons (#54242).
+
+       * src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
+
+2018-07-05  Werner Lemberg  <address@hidden>
+
        Fix more 32bit issues (#54208)
 
        * src/cff/cffload.c (cff_blend_build_vector): Convert assertion into
diff --git a/src/sfnt/ttcpal.c b/src/sfnt/ttcpal.c
index f01d88c..b4b60e2 100644
--- a/src/sfnt/ttcpal.c
+++ b/src/sfnt/ttcpal.c
@@ -112,6 +112,10 @@
     cpal->num_colors = FT_NEXT_USHORT( p );
     colors_offset    = FT_NEXT_ULONG( p );
 
+    if ( CPAL_V0_HEADER_BASE_SIZE             +
+         face->palette_data.num_palettes * 2U > table_size )
+      goto InvalidTable;
+
     if ( colors_offset >= table_size )
       goto InvalidTable;
     if ( cpal->num_colors * COLOR_SIZE > table_size - colors_offset )
@@ -128,7 +132,9 @@
       FT_UShort*  q;
 
 
-      if ( face->palette_data.num_palettes * 2 + 3U * 4 > table_size )
+      if ( CPAL_V0_HEADER_BASE_SIZE             +
+           face->palette_data.num_palettes * 2U +
+           3U * 4                               > table_size )
         goto InvalidTable;
 
       p += face->palette_data.num_palettes * 2;